Roll Go 1.27.2 to 1.27.3 and service-go-grpc 0.1.54 to 0.1.58 (GO-2026-6809) #1204

What is broken

Codefly supply chain (and so Release gates) is red on every pull request: codefly audit service accounts --fail-on-vuln stops on GO-2026-6809, a crypto/x509 vulnerability in the Go standard library, found in go1.27.2 and fixed in go1.27.3. govulncheck on the accounts service reproduces it locally. It is not caused by any one PR — #1197 and #1201 both fail on it.

Where the fix already is

service-go-grpc moved to Go 1.27.3 (service-go-grpc#188, PRs #189/#190) and released v0.1.58 on 2026-10-21. This repository still pins the go-grpc agent at 0.1.54 and Go 1.27.2.

What moves

• .github/workflows/ci.yml: go-version: "1.27.2" → "1.27.3" (10 places).
• go 1.27.2 → go 1.27.3 in module/services/accounts/code/go.mod, module/services/auth-gateway/code/go.mod, module/frontendpayload/go.mod (and any other Go module that states it).
• Builder images: golang:1.27.2-alpine3.23@sha256:… in module/services/{accounts,auth-gateway,policy-log,telemetry}/builder/Dockerfile and scripts/ci/build-images.json, to the image v0.1.58's builder template uses (digest-pinned).
• Agent pin go-grpc 0.1.54 → 0.1.58 for every go-grpc service, through the CLI verb that owns it (codefly update workspace / the deployment agent-version procedure in module/deployment/AGENTS.md), not by hand; regenerate whatever records the agent version (e.g. module/contracts/runnables/**/runnable-package.json) with CI's pinned toolchain.
• Prose that states the pin: module/AGENTS.md (Go/agent version paragraph), the comment in module/services/accounts/service.codefly.yaml.

Changing only CI's go-version would be a hack: the gate would pass while the images that ship are still built on 1.27.2.

Done when

Codefly supply chain and Release gates are green on the PR and on merge_group, and the shipped builders are on Go 1.27.3.