build: require Go 1.27

[pkkummermo]

Part 1 of #54: raise the minimum Go version so the validation API refactor in #100 and #101 can use
generic methods.

Generic methods (golang/go#77273) landed in Go 1.27.0,
which is now GA. The CI matrix drops 1.25 and 1.26 rather than keeping compatibility rows that could
not compile the API that follows.

The allocation gate moved

encoding/json.Marshal allocates twice per call on 1.27 where it allocated once on 1.26, confirmed
in isolation:

go1.26: json.Marshal allocs: 1
go1.27: json.Marshal allocs: 2

So the two budgets that marshal JSON move with it — json 15 → 16, and not found 36 → 38 for its
nested error payload. Every budget that does not marshal JSON is unchanged, and no govalin code on
those paths changed. This is the case perf_test.go already anticipates: "escape analysis and
inlining change between releases."

Note for anyone working on #100 / #101

The standalone gofumpt binary cannot parse generic methods yet — it fails with method must have no type parameters (mvdan/gofumpt#359, fix expected
shortly). This does not affect CI: golangci-lint-action resolves version: latest, and
golangci-lint ≥ v2.13.1 built with go1.27 embeds a gofumpt that parses them (verified: clean run and
clean fmt --diff against generic-method code). Locally, use golangci-lint fmt ./... instead of
gofumpt -w on files with generic methods until the fix ships.

Verification

• go build ./..., go test ./..., go test -race ./... pass on go1.27.0
• GOVALIN_PERF_GATE=1 go test -run TestAllocationBudget . passes with the updated budgets
• golangci-lint run ./... clean

🤖 Generated with Claude Code

[pkkummermo]

Analyze (go) is red for a toolchain reason, not a code reason

CodeQL's autobuild pins GOTOOLCHAIN=local and the runner image ships Go 1.26.6, so raising
go.mod to 1.27.0 puts the module out of reach. It fails before parsing any Go source:

go: go.mod requires go >= 1.27.0 (running go 1.26.6; GOTOOLCHAIN=local)
Extraction failed for all discovered Go projects.

Analyze (actions) passes because it never touches Go.

There is a second failure behind it: the runner's bundle is CodeQL 2.26.3 (released Aug 12) and its
autobuilder reports built with go1.26.5, so the extractor could not parse generic methods even
with Go 1.27 installed.

No configuration change here would fix either half. CodeQL's own tracking issue
github/codeql#22042 "Go: Update to 1.27" closed on
Aug 20, so support is merged upstream and waiting on a bundle release — 2.26.3 predates it. The
check should go green on its own once the new bundle rolls out to Actions, with no change to this
branch.

main is unprotected and this is not a required check, so it does not block merging.