[vt128]

Restore the CLI validation pipeline on supported macOS runners and allow checks for the stacked security/documentation PRs. Production build and packaging jobs use Go 1.27.4 to address the new net/http advisory GO-2026-6859.

Validation passed with the official checksum-verified Go 1.27.4 compiler for the main and examples modules, including build, race tests, vet, module checks, actionlint and the normal commit hook. The compiler update changes four version literals in the two workflows, and the source, tests, module declarations and dependencies retain their reviewed contents.

The production vulnerability gate still fails on five reachable x/net advisories. Full package/module findings are retained in the review. This PR remains a draft while dependency compatibility and the packaging/installation gates are resolved.

Superseded by security PR #43, merged as fb9fdd8. That PR consolidates this reviewed change with the approved CLI/kit/examples Go 1.26 minimum and secure production dependencies; the separate docs follow-up #42 is also merged. This historical PR is closed without merging, and its original source/check evidence remains intact.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.99%. Comparing base (a6877c3) to head (50258c2).

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #40   +/-   ##
=======================================
  Coverage   87.99%   87.99%           
=======================================
  Files          23       23           
  Lines        1166     1166           
=======================================
  Hits         1026     1026           
  Misses        108      108           
  Partials       32       32           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.