[the-sarge]

Updates the validation/compiler selection to Go 1.27.2, golangci-lint to v2.14.0 and govulncheck to v1.9.0, plus x/crypto v0.58.0 and x/sys v0.49.0. The Go 1.27 consumer floor, DTLS selection, public behavior, tool overrides and existing CI gates are preserved.

Part of https://github.com/the-sarge/infra/issues/686; this PR completes only the turn portion. No release is required by this metadata/dependency update.

Validation: Go 1.27.2 with GOTOOLCHAIN=local, go test ./..., task dependency-gate and task workflow-check (20 range cases). Final preflight, bounded RAS review, and exact-head hosted CI follow before readiness/merge.

[the-sarge]

Review and local certification completed for bcec8b5c1dc7e800a7f49b57846427620f347831, base dbe09149cd52af9e0efd8170eaa30e26bc69c809.

• RAS 20261014T235236-cb0f240e7d11c8f952f81980: all six reviewers and synthesis completed, zero findings/follow-ups. Independent disposition: nothing to fix, defer, reject or escalate; no verification/replacement required.
• Go 1.27.2, GOTOOLCHAIN=local: root/consumer-floor tests, dependency and workflow checks, race tests passed.
• Final task preflight passed at the exact pushed head with clean worktree: core formatting/vet/tests/lint, docs, race, dependency, cross-build, workflow and full-history secret scan. Govulncheck reports zero reachable vulnerabilities; one module-only advisory does not affect imported packages.
• The initial concurrent lint attempt hit the tool's parallel-process lock; final serial lint/preflight succeeded after review completed. No source changes or gate bypasses were needed.

Marking ready for the independent hosted ci-required check on this same head. No release tag is needed; infra #686 remains partial because cpace is blocked separately.