govulncheck fails on GO-2026-6809: bump Go from 1.27.2 to 1.27.3 #494

The pr-run-checks-go / Go vulnerability analysis lane now fails on every pull request: govulncheck found 1 reachable vulnerable-symbol result(s): GO-2026-6809 (run 39987909632, on #493, which changes no Go code).

GO-2026-6809 ("Distrust compromised intermediate certificates in crypto/x509") affects the standard library before 1.26.10 and 1.27.0 through 1.27.2, fixed in 1.27.3 (vuln.go.dev record). go.mod pins go 1.27.2.

Fix: move the go directive to 1.27.3 and the places that restate it (AGENTS.md toolchain notes, GOTOOLCHAIN=go1.27.2, .cursor/environment.json, release/dependencies.json, .github/workflows/release-publish-image.yml). The last push run on main passed on 2026-10-20, before the advisory was published.

🤖 Generated with Claude Code