Complete Go 1.27.2 upgrade after official gosec compatibility fix #320

Outcome

Finish the remaining cpace component of infra batch #686 by resuming draft PR #319 once a qualifying official standalone gosec release supports Go 1.27.2. This is the existing batch obligation, not an additional portfolio batch.

Blocked on official scanner compatibility

At the last verified release check, official gosec v2.29.0 remained newest. Its x/tools v0.49.0 importer cannot read Go 1.27.2 export-data version 5 and skips SSA analysis. Building that unchanged official module with Go 1.27.2 did not fix the importer. A SARIF file alone is not evidence of successful scanning. Recheck official availability before resuming; do not blindly rerun the unchanged failed candidate.

Acceptance criteria

• Select a compatible official gosec release through the existing supported installer and record its version/provenance. No custom build, private dependency overlay, unreleased pin, distribution-channel change or scanner bypass.
• Resume PR chore: prepare Go 1.27.2 tools (blocked on gosec) #319 after reconciling current main, branch and repository instructions. Complete the approved Go 1.27.2/compiler and analyzer updates while preserving consumer floors, runtime dependencies, public API and historical evidence.
• Required standalone task gosec succeeds with its existing test-inclusive scope, no import/SSA analysis failures, and SARIF output. Preserve release failure propagation and SARIF upload.
• Pass existing tool-helper, release-policy, module, security and task check gates. Complete bounded RAS review, independent finding dispositions, final exact-head local certification and required hosted CI.
• Merge the certified PR and then merge its development-journal entry. Publish no new library release unless an accepted downstream requirement actually needs one.
• Update infra #686 and its OmniFocus tracking with the final evidence; close the batch only once its remaining obligations are delivered.

Downstream boundary

This blocker applies to cpace. The audited scheduling decision removed the blanket #686 → #687 dependency: Wiremux and Wellspring do not select cpace, and Codemux can retain cpace v0.1.3. Do not re-block unrelated batches. Restore a dependency only for accepted work that actually needs new cpace runtime/API content or the pending artifact. Keep the incomplete cpace deferral explicit in portfolio closeout.