chore(go): upgrade toolchain to Go 1.27 and bump vulnerable dependencies

[devin-ai-integration]

Summary

Production currently builds with golang:1.24.13, which is outside Go's support window (only 1.27/1.26 receive security patches). govulncheck ./... on the pinned toolchain reported 31 vulnerabilities reachable from harp's code — 25 in the standard library, 6 in dependencies. After this PR it reports 1 (see below).

Changes:

• Dockerfile / dev.Dockerfile: golang:1.24.13 → golang:1.27.1
• go.mod: go 1.24.0 + toolchain go1.24.11 → go 1.27.0 (toolchain line dropped; the go directive is enough)
• .github/workflows/audit.yaml: setup-go 1.24.x → 1.27.x; staticcheck@v0.6.1 → @v0.8.1 (v0.6.1 does not understand Go 1.27 export data)
• Dependency bumps for the modules govulncheck flagged, plus their required transitive floor:
  • jackc/pgx/v5 v5.8.0 → v5.9.2
  • go-jose/go-jose/v4 v4.1.3 → v4.1.4
  • nyaruka/phonenumbers v1.0.73 → v1.8.1
  • go.opentelemetry.io/otel{,/sdk,/metric,/trace,/sdk/metric} v1.39.0 → v1.43.0
  • google.golang.org/grpc v1.78.0 → v1.82.1
  • golang.org/x/net v0.49.0 → v0.56.0, golang.org/x/text v0.33.0 → v0.39.0 (and the x/crypto, x/sys, x/oauth2, x/sync, x/mod, x/tools versions they pull in)
• .claude/skills/ci-pipeline/SKILL.md updated to match the new versions.

No application code changes. go mod tidy also merged the two require blocks, which is why the go.mod diff looks larger than it is.

Deliberately left alone: github.com/go-chi/chi v1.5.5

The one remaining govulncheck finding is GO-2026-4316 (open redirect in chi's RedirectSlashes middleware, "Fixed in: N/A" for the v1 line). Harp does not use RedirectSlashes, so it isn't exploitable here. Moving to chi/v5 is a module-path change across every handler file and chi v5.3.x deprecates middleware.RealIP (which harp uses, and which fails the new staticcheck). That migration is done in the rate-limiter PR, where replacing RealIP is the actual point of the change — keeping this PR a pure toolchain/dependency bump.

Verification (with GOTOOLCHAIN=go1.27.1)

• gofmt -l . clean, go mod verify ok, go build ./..., go vet ./..., staticcheck ./... (v0.8.1) all pass
• go test -race ./... passes
• govulncheck ./...: 31 → 1 (the chi RedirectSlashes advisory above)

Related: #153 (push endpoint hardening); rate-limiter PR to follow.

Link to Devin session: https://app.devin.ai/sessions/7730c9bccc574233a0c2650ba204bec2
Open in Devin Desktop: https://app.devin.ai/desktop/session/7730c9bccc574233a0c2650ba204bec2?variant=devin
Requested by: @balebbae

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring