Update Go build and analysis toolchain to 1.27.1

[jeremydixon22]

Summary

Dependabot #125 updates the worker image to Go 1.27.1 but leaves the four build/analysis workflows and the version-policy checker at 1.26.6, causing both release-boundary gates to fail. Apply the proposed digest-pinned image together with all five companion pins and refresh the public-export manifest.

The earlier Go 1.27 deferral is resolved: the already-pinned CodeQL action v4.37.9 defaults to bundle 2.26.4, whose Go library changelog records Go 1.27 support. Hosted Go extraction succeeded for both modules; the SARIF reports no extraction warnings or errors and no findings.

Supersedes #125.

Verification

• Go 1.27.1 tests and go vet pass for both modules (the worker module has no unit tests).
• Version policy, PR release boundary, public-export reproducibility, and pre-push locked solution restore pass.
• All hosted PR checks pass, including .NET/client tests, all four CodeQL languages, container scanning, and execution-consumer validation.
• The digest-pinned worker image builds locally. Python verification passes all 235 tests at 79.1% coverage, strict type checks, package builds, and clean installs with coverage 7.16.0.
• Release-mode public-export verification passes with the supplied operator policies. The full release rehearsal runs on canonical main.

Public information review

Does this change expose new public information? No

Compatibility and operations

The build toolchain moves to Go 1.27.1. The public Go module minimum remains 1.25.0. The worker image remains pinned by digest; no package versions or workflow permissions change.