[galacto-last9]

Require certifi >=2026.10.19 and build all Go modules and the collector with Go 1.27.3 to reject the compromised eMudhra chains. Update the bundled pip CA store to 26.2.2, refresh Debian CA certificates in the Python image, and include the Go version in the collector-builder cache key.

Regenerate the hashed development lockfile on supported Python 3.10, correcting incompatible cffi, pydantic-core, and protobuf pins and adding missing conditional dependencies. CI now installs the actual hashed lockfile before running checks. Add a reusable TLS smoke check and rebuild guidance in SECURITY.md.

Validation:

• Clean hashed installs and pip check on Python 3.10/Linux and Python 3.12/macOS.
• Linux Python suite: 940 passed, 2 skipped.
• Flake8 and Black pass. Mypy output is identical to unchanged main: 154 existing errors in 45 files; CI treats this check as advisory.
• All four Go modules pass go test -race -count=1 with Go 1.27.3.
• Collector OCB build and example-config validation pass; binary build metadata confirms go1.27.3.
• Fresh Python wheel and sdist build and pass twine check.
• Python image rebuilt with --pull --no-cache; certifi and system CA stores reject both direct and cross-signed eMudhra test chains, while example.com succeeds.
• Go 1.27.3 TLS client rejects both test chains as revoked and accepts example.com.

Part of last9/last9#11942. Incident and patched versions: https://emudhra.we-have-a-problem.com/.

Existing published artifacts still require a new release; this PR prepares the patched sources and build paths.