[jeremydixon22]

Summary

• bump the enforced Go build toolchain from 1.27.2 to 1.27.3
• pin the worker builder to the official 1.27.3 multi-platform digest
• keep CI, CodeQL, release integrity, and execution-consumer workflows aligned with the version policy

Failure addressed

Release Integrity and scheduled Container Security both rejected CVE-2026-111943 in the Go 1.27.2 standard library embedded in the execution smoke worker. CI feedback correctly reported those primary failures.

Validation

• version, publication, and worker-container release policy checks pass
• Go client and worker tests pass under the pinned 1.27.3 image
• worker container builds successfully
• pinned Trivy 0.73.0 scan reports 0 HIGH/CRITICAL vulnerabilities and 0 embedded secrets
• stale 1.27.2 references: 0