[cory-salad]

Summary

The CLI talks to the SaladCloud API over HTTPS, and it checks the server's certificate with the certificate code in
Go's standard library, which is built into every binary. The Go version we pinned, 1.27.2, does not reject certain
intermediate certificates that are known to be compromised
(GO-2026-6809). The vulnerability scanner in our lint step found that the
CLI's code can reach that check, so just ci and CI's lint job failed on main and on every branch. This pins Go
1.27.3, which rejects those certificates. Release builds take Go from the same pin, so the next binaries and container
image include the fix.

This PR also lets pull requests run CI while the repository is private. main's ruleset requires lint, package
and test on all three OSes, but test.yml skipped every job on pushes and pull requests while the repository is
private. A skipped matrix job reports only as plain test, and a run started by hand doesn't count toward a pull
request, so no pull request could ever report the required checks. The two changes go together because neither can
merge alone: a CI-only PR fails lint on Go 1.27.2.

Changes

• mise.toml: go = "1.27.3". test.yml and release.yml install Go from here through .github/actions/setup-mise.
• go.mod: toolchain go1.27.3, to match. The go 1.25 line stays, so the minimum Go for go install is
  unchanged.
• CHANGELOG.md: a ### Security entry under Unreleased.
• .github/workflows/test.yml: test, lint and package now run on pull requests while the repository is private
  (github.event_name != 'push' || !github.event.repository.private). Branch pushes still run nothing while private,
  and install-scripts stays hand-run (gh workflow run test.yml --ref <branch>) to save macOS minutes. Once the
  repository is public, every job runs on every event, as before, so nothing needs undoing at launch.

Nothing else pins the Go version: .goreleaser.yaml, the workflows and the Dockerfile all inherit it.

Checklist

• just ci passes (formatting, lint, and the offline tests): run locally on Windows with Go 1.27.3; govulncheck
  reports no vulnerabilities. This PR's own run now reports the required checks on all three OSes.
• docs/ (and the README, if install or getting started changed) and CHANGELOG.md (under Unreleased) reflect the
  change: CHANGELOG updated for the Go bump; the CI change isn't user-visible; nothing in docs/ or the README
  names the Go patch version.
• Anything that touches an API call was exercised live, or this pull request says it was not: no API call changed,
  but the new toolchain changes the certificate check behind every HTTPS request. The live suite was not run.

🤖 Generated with Claude Code