Acceptance Criteria
- #1 All Go module, build and release pins use 1.27.3 and gate passes
- #2 Current Renovate PRs are merged or have recorded blockers
- #3 Published release has verified Go and certificate trust evidence
Definition of Done
- #1 just check
- #2 just gen (if any generated artifact changed) and the diff committed
Implementation Notes
Aligned root and PromQL tool modules, cloud bootstrap, release workflows and both builder stages to Go 1.27.3. Verified registry index digests directly. Builder CA 20260909-r0 accepts one affected endpoint; apk upgrade to 20261020-r0 makes both reject with certificate verification errors. Runtime distroless package metadata shows ca-certificates 20250419+deb13u1. Full remote gate running. CodeRabbit skipped for dependency pins and declarative build wiring.