Bump go.mod to the shipped Go; guard Go, tool pins, RBAC and metrics drift #441

Severity: High (shipped binary is built by a toolchain no test or govulncheck run used) · Landing order: 4 of 10 · Blocked by: #440

go.mod says go 1.26.6 while Dockerfile:2 and Dockerfile.pipeline:4 build with a newer image, so tests and govulncheck never saw the shipped toolchain. Pinned go run/go install tools, the kustomize role vs chart roles, and metric names in docs/chart vs internal/metrics/ are also compared by nobody. Outcome: go 1.27.1 plus guards for each invariant (each with a negative self-test) and a weekly Go patch-lag sensor.

Spec: openspec/changes/cross-file-consistency-gates/ — requirements CFC-1..6; proposed in #437.

Tasks (one PR; red test first — see tasks.md):

• 1. Go equality guard and bump to go 1.27.1, Renovate group, probes (1.1-1.3)
• 2. consistency_tool_pins_test.sh via go mod download -json (2.1)
• 3. consistency_rbac_test.sh with exceptions file; fix real drift separately (3.1-3.2)
• 4. hack/ci/go-patch-lag.sh and weekly go-patch-lag.yaml, zizmor-clean (4.1)
• 5. consistency_metrics_test.sh; fix real drift separately (5.1-5.2)
• 6. Run all guards in lint and task check; merge with post-merge row open (6.1-6.2)

Done when: every Verification row in tasks.md is pass (or post-merge with its follow-up issue linked), the independent review is recorded, and the change is archived.

Source: spec/oss-quality-signals @ 1745b60b (independent review + cold adversarial review, 2026-10-05).