[merefield]

Changes

• Pin Go 1.27.3 in go.mod and update the README. This fixes GO-2026-6809, which failed the scheduled Security run on master.
• Update the Go modules used by the application and tests to the latest versions on their existing module paths, and tidy go.mod and go.sum.
• Update govulncheck to v1.9.0 and the Bats GitHub Action to 4.1.0.
• Port Codexometer’s duplication ratchet and baseline writer for production Go. Gate exact matches at 50 and 100 tokens separately and report normalised matches and test duplication for review. The first successful master CI run writes the measured baseline.

Verification

• Linux formatting, vet, race tests, and build passed.
• All 10 Unix installer tests passed.
• macOS ARM64 and Windows AMD64 cross-builds passed.
• The Linux vulnerability scan reported zero reachable vulnerabilities.
• All 10 duplication tooling tests passed, including regression detection, baseline ownership and policy migration. Verified the workflow with actionlint and exercised baseline initialisation and a no-op repeat on Termcourse.