Upgrade to Go 1.27

[monorkin]

Bumps the toolchain to Go 1.27.0 across everything that pins it:

• .mise.toml, go.mod, and tests/smoke/go.mod move to 1.27.0. CI workflows read go-version-file: go.mod, so they follow on their own.
• nix/go.nix moves its base to go_1_27 with minGo = "1.27.0" and the official source-tarball hash. The pinned nixpkgs only carries 1.27rc3, so the file's existing conditional override rebuilds from the upstream tarball and drops itself once nixpkgs catches up — the same pattern it used for 1.26.6.
• golangci-lint moves v2.11.1 → v2.13.1 in lockstep (Makefile tools, both workflows, pre-commit, and the MIN_VERSION floor in scripts/check-lint-lockstep.sh). The old binary was built with Go 1.26 and refuses a 1.27 target; v2.13.1's release binaries are built with Go 1.27.0.
• README's from-source instructions now say Go 1.27+.

make check passes in full locally: fmt, vet, lint (0 issues), all tests, tidy-check, surface snapshot, and both lockstep checks. The nix path is unverified locally (no nix on this machine) — the nix-build job is the check for that.

Dependency

PR #304 is the cached-Go 1.26.6 foundation and should merge first. After it lands, sync this branch with current main before advancing #296. The PR base remains main for now; no history is rewritten while the foundation is under review.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/release.yml
• .github/workflows/test.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[jeremy]

CodeQL support for Go 1.27 coming in a release later this week.

[jeremy]

Rebased onto main and pushed to go-1.27 (8c5c8b8); both commits are preserved.

Three conflicts, all bookkeeping: main moved the README's "From source" paragraph into docs/install.md, so the Go 1.27 wording went there; nix/go.nix kept this PR's conditional source-tarball override for go_1_27 (main had since simplified the 1.26 variant to plain go_1_26; #296 on top of this does the same for 1.27 with a nixpkgs lock that carries Go 1.27.0); and the lockstep bats fixture keeps both main's gosec assertion and this PR's v2.13.1 pins.

On the red checks: Tests and Race Detection failed on TestDayViewRulesFallFromEveryHourWithoutCuttingIntoAnEvent, which was pinned to 2026-08-24 and ran against the wall clock on that very day; main has since given it a fixture clock, so the rebase picks that up. The failing Analyze (go) is GitHub's default-setup CodeQL run (event dynamic), not codeql.yml — the default setup autobuilds with the runner image's own Go under GOTOOLCHAIN=local, which was 1.26.6 in August and refuses a 1.27.0 go.mod. codeql.yml's own Analyze (go) sets up Go from go.mod and passed. That check is not in the required set and nothing in the repo steers it; it clears once the runner image ships Go 1.27.

Locally on Go 1.27.0 with golangci-lint v2.13.1: make check passes, and make test-e2e passes every lockstep and release-tooling test (the only bats failures are install_ssh_key.bats using GNU stat -c on macOS, unrelated to this change).