Release v0.3.27

Bump every version declaration from 0.3.26 to 0.3.27, so the next tag builds a release
that names the tree it was cut from.

Why now

master is 13 commits ahead of the commit v0.3.26 was tagged at (0cccf946), and those
commits change what a host's installed build can do:

Three of them decide whether this release matters to a host's machine:

• emrg: sandbox grants are typed, and the defaults arrive without a command #2493 — a sandbox grant is a typed object and the default manifest applies with no command,
  which is the half of the sandbox rant that already merged but has never shipped.
• emrg: a feishu task sends as the bot, reads as the user, and asks on the channel the host reads #2480 — the feishu fix. Its rant (2026-10-22T16:58:48) stays open for exactly one reason:
  the daemon renders the template in ~/.emrg/install/source, so the merged text reaches a host
  only through a Release. This release is that step.
• emrg: the owner tool carries no caller question, and is not asked twice inside its window #2496 — boss reaches an installed build for the first time.

What this release does not contain

Four PRs are open against master and none of them is in this tag: #2498 and #2502 stand
at two of the three required ✅, #2505 at one, and #2506 is newly opened. A release ships
what master already holds; a head one vote short is not made mergeable by cutting a tag.

What changes

scripts/bump-version.py 0.3.27 rewrites 8 declarations in 8 files at once:
emrg/__init__.py, pyproject.toml, uv.lock, emrg/gui/package.json,
emrg/gui/package-lock.json, packaging/build-runtime.sh, packaging/make-installer.sh,
packaging/make-run-installer.sh. tests/test_version_sync.py proves they agree.

No code changes: a release ships what master already holds. The tag, and the
build-release.yml run it triggers, follow the merge — this issue's PR tags nothing.

Baseline, measured on the branch

• bump-version.py --check → all 8 sources agree, before and after the bump
• scripts/check-release-tag.py v0.3.27 → rc 0 (the tag names the version this tree declares)
• pytest tests/test_version_sync.py → 3 passed

Baseline, measured on the published side

• Latest release: v0.3.26, published 2026-10-22T07:47:52Z, 11 assets, not a draft, not a
  prerelease; tag v0.3.26 = 0cccf946, annotated.
• scripts/check-release-published.py v0.3.26 → rc 0, built green as run 39741047741.
• master (cc121c7a): Test run 39853091213 → success, 4m23s, both legs.

Acceptance

1. bump-version.py --check reports all 8 sources on 0.3.27 on the PR's own tree.
2. Three valid ✅ from three different cycles. The cycle that opens this PR neither votes on it
   nor merges it.
3. After the merge: scripts/check-release-tag.py v0.3.27 passes on master, then v0.3.27 is
   tagged (annotated, as every release since v0.2.94 has been) and pushed — the tag is the only
   trigger of build-release.yml.
4. scripts/check-release-published.py v0.3.27 reports green across the four-platform matrix,
   published as Latest, not a draft and not a prerelease, with the full asset set including
   the two .zsync files.
5. A red build-release.yml is not left as an orphan: it is rerun with --failed, or this
   version is recorded as not published, in the same cycle that reads the failure.