[Gugic]

The maintained GoTrue branch fails its vulnerability gate on 13 findings, its Staticcheck pin cannot read Go 1.27.2 compiler data, and fork CI queues on inherited Supabase Blacksmith runner labels. This updates the dependency/toolchain baseline and makes PR checks runnable before the verification hardening in #1.

• Align all five Go pins at 1.27.2; update x/net to 0.60.0, the OTel SDK/exporter family to 1.45.0, gRPC to 1.83.1 and the required transitive modules.
• Update Staticcheck to 0.8.2, whose release notes explicitly cover Go 1.27.2 export-format compatibility.
• Run PR validation, conventional-commit and dogfooding checks on standard GitHub-hosted ubuntu-24.04 runners.
• Rebuild cached tools when their module pins change. A regression test covers both Make entrypoints and both manifest files; it fails on the unchanged base and passes here.
• Point the setup guide at go.mod and retain the bounded test-only Argon2 request deadline used in fix(auth): bound email verification attempts and randomize links #1 so race/coverage instrumentation tests state transitions reliably.

Targets inworld/v2.197.0 independently of #1. Merge this PR first, then refresh #1 from the maintained branch. Auth-handler and schema changes remain in #1. Building a future fork tag will also require matching the deploy repository's Go builder pin as part of that release.

Verified:

• Complete make lint passes with Go 1.27.2, including Staticcheck, gosec and the vulnerability gate. All 13 previous findings are cleared; the two existing documented no-fix exceptions are retained.
• Complete make test passes: 41 packages, race detection, repository-wide coverage and the mandatory coverage gate, against a fresh local PostgreSQL database.
• Nested dotenv race tests pass; Linux amd64 cross-compilation succeeds.
• Actionlint and ShellCheck pass on the three modified CI workflows.
• All six GitHub checks pass on d0dd95d9, including the PostgreSQL, OrioleDB and Multigres jobs: https://github.com/Gugic/auth/actions/runs/39486070810.
• An unpublished Git merge tree with fix(auth): bound email verification attempts and randomize links #1 is conflict-free; its H1 security and shared-attempt regression suites pass under the upgraded toolchain and dependencies.

Not verified:

• Human review. After this PR merges, fix(auth): bound email verification attempts and randomize links #1 must be refreshed from the maintained branch to inherit the runner and dependency changes.
• Container image build or deployment; no release tag was created.