dev: Update Go to 1.27 and update dependencies

[nicholaspcr]

Summary

Bump the go directive and toolchain to 1.27 in the root and tools modules, and update the dependencies of both.

Changes

• Bump go to 1.27 and toolchain to go1.27.0 in go.mod and tools/go.mod.
• Update the dependencies of the root and tools modules.
• automemlimit v1.0.0 removes SetGoMemLimit. Replace it with the equivalent Set(WithRatio(0.9)), which keeps the same FromCgroup provider and ratio.
• Hold html2text at its current version: newer releases import github.com/olekukonko/tablewriter/tw, which does not exist in the tablewriter v0.0.5 that the replace directive pins.
• Bump golangci-lint to v2.13.2 for Go 1.27 support.

The existing replace directives are untouched, so redis stays at v9.18.0, bun at v1.2.15, gocloud.dev at v0.41.0, tablewriter at v0.0.5 and mapstructure at the TTI fork.

Testing

Steps

1. go build ./... in the repository root and in tools.
2. go vet ./pkg/... ./cmd/....
3. go test ./pkg/... with the usual Redis and CockroachDB dependencies running.
4. Verify that CI installs Go 1.27 (.github/actions/install-go-and-deps reads go-version-file: go.mod) and that the lint job passes.

Results

go build ./... is clean in both modules. go vet ./pkg/... ./cmd/... reports only the three pre-existing findings in pkg/rpcmiddleware/rpcretry/client_interceptors_test.go and pkg/unique/unique_test.go, which are unrelated to this change. Targeted tests for pkg/email, pkg/redis and pkg/config pass locally. The full test suite has not been run locally because it requires Redis and CockroachDB; CI covers it.

Regressions

This touches every Go package by way of the dependency graph, so the full CI test suite is the regression check.

The only behavior change outside the module files is GOMEMLIMIT configuration in cmd/ttn-lw-stack/commands/root.go. memlimit.Set(memlimit.WithRatio(0.9)) is the v1.0.0 equivalent of SetGoMemLimit(0.9): same default FromCgroup provider, same ratio. To verify, run the stack in a container with a memory limit and confirm that GOMEMLIMIT is set to 90% of the cgroup limit and that no "Failed to set GOMEMLIMIT" log line appears.

Notes for Reviewers

The html2text hold is the one deliberate omission from the dependency update. The tablewriter replace directive pins v0.0.5, which has no tw subpackage, so any newer html2text fails to build pkg/email. Removing that replace directive is a separate change with a wider blast radius.

Checklist

• Scope: The referenced issue is addressed, there are no unrelated changes.
• Compatibility: The changes are backwards compatible with existing API, storage, configuration and CLI, according to the compatibility commitments in README.md for the chosen target branch.
• Documentation: Relevant documentation is added or updated. No documentation references the Go version; CI reads it from go.mod.
• Testing: The steps/process to test this feature are clearly explained including testing for regressions.
• Infrastructure: If infrastructural changes (e.g., new RPC, configuration) are needed, a separate issue is created in the infrastructural repositories. None needed.
• Changelog: Significant features, behavior changes, deprecations and fixes are added to CHANGELOG.md. No entry added, consistent with previous Go and dependency updates.
• Commits: Commit messages follow guidelines in CONTRIBUTING.md, there are no fixup commits left.