[vishr]

What changed

The release workflow's binary job pinned Go 1.27.2 in a GO_VERSION variable, while go.mod moved to 1.27.3 in #368. With GOTOOLCHAIN=local, every binary build failed with:

go: go.mod requires go >= 1.27.3 (running go 1.27.2; GOTOOLCHAIN=local)

As a result, v2026.10.21-alpha published its GHCR and Docker Hub images but no native archives, GitHub Release, or MCP Registry entry. The binary job now uses go-version-file: go.mod, like every other job, and the stale variable is removed.

Verification

• Only workflow YAML changed; no Go, UI, or docs change
• go.mod is now the single Go version source for the CI, CodeQL, site, and release jobs; the Dockerfile pins golang:1.27.3 by digest
• No credentials, private telemetry, host details, or enterprise-only source are included
• Release-contract change called out: none; the next release tag exercises the binary job

[vishr]

Codex review (base origin/main): no findings. The release binary builds now select Go from go.mod, consistent with the other workflows, and GO_VERSION has no remaining references.