Upgrade to Go 1.27.2

[tnsardesai]

Summary

Go 1.25 and older are out of support now that Go 1.27 has shipped. This moves the repo to the latest patch release, Go 1.27.2.

module	before	after
server/go.mod	go 1.25.0	go 1.27.2

Other places that pin the Go toolchain:

• images/chromium-headless/image/Dockerfile, images/chromium-headful/Dockerfile: docker.io/golang:1.25.0 -> docker.io/golang:1.27.2
• CI (server-test, chromium-launcher-test, vuln-remediation) reads go-version-file: server/go.mod
• AGENTS.md, server/README.md: required Go version

Other changes needed for the upgrade:

• go mod tidy removed 349 stale server/go.sum lines for module versions no longer in the graph.

Breaking changes and GODEBUG review

Raising the go line changes these defaults (none are overridden in this repo, via godebug blocks, //go:debug or GODEBUG env):

• Go 1.26: urlstrictcolons=1 (url.Parse rejects extra colons in the host), cryptocustomrand=0 (crypto ignores caller-supplied rand readers), tlssecpmlkem=1 (SecP256r1MLKEM768/SecP384r1MLKEM1024 on by default)
• Go 1.27: tracebacklabels=1 (pprof goroutine labels are printed in tracebacks)

Removed outright in 1.27 (new behavior regardless of the go line): asynctimerchan, gotypesalias, tls10server, tlsrsakex, tls3des, tlsunsafeekm, x509keypairleaf. None are set here.

Toolchain changes that apply as soon as 1.27 builds the code: encoding/json runs on the v2 implementation (same behavior, different error text), HTTP/1 Response.Body.Close drains unread bodies, ServeMux trailing-slash redirects are 307 (1.26), Green Tea GC is on (1.26), go test runs the stdversion vet check, and gofmt alignment changed slightly.

Repo-specific findings:

• server/ builds with CGO_ENABLED=0, and the bare golang:1.27.2 tag is Debian trixie, as golang:1.25.0 was, so the builder base distro does not change.
• github.com/go-json-experiment/json (pulled in by chromedp) is at a 2025-07 revision that predates the goexperiment.jsonv2 alias files, so it still compiles with 1.27's default jsonv2 experiment. Newer revisions from Aug-Sep 2025 do not compile on 1.27 until they reach the 2026-08 revision; bump it to v0.0.0-20260820222146-c27c302e5fc3 or later if chromedp is upgraded.
• The neko server module is replaced by github.com/kernel/neko/server; the neko base image used by the headful image is built from that repo and is upgraded separately.
• Unix-socket clients (playwright_executors.go, browser_repl.go, lib/x11) never compare read errors with == io.EOF, so 1.27 returning a bare io.EOF from UnixConn reads changes nothing. No encoding/json error text is matched anywhere.

Verification

• kernel-images/server: go build ./... pass, go vet ./... pass, go test -short ./... 27 ok / 1 failed on 1.27.2 (baseline on the pre-upgrade toolchain: 27 ok / 1 failed)
• Unit tests per AGENTS.md (go test -race excluding e2e): 27/27 packages ok
• server/e2e fails identically before and after: the tests start prebuilt onkernel/chromium-*-test images, which aren't available locally.
• Built the server-builder stage of the headless Dockerfile on golang:1.27.2.