feat: add Chrome 155 H2 profile and refresh TLS security baseline

[cppla]

Changes

• Add explicit chrome-155 H2 profile using HelloChrome_155, plus CLI/JSON h2-fingerprint and web-auto H2 fallback propagation.
• Preserve chrome-133 and the legacy omitted/empty default; newly generated web bundles explicitly pin 155. Native transport and the H3 profile are unchanged.
• Compare actual AutoCAR cold ClientHello bytes against the licensed historical official Chrome 155.0.8059.40 capture, with exact fixture checksum, documented normalization, positional GREASE checks and negative controls.
• Extend 133/155 TLS policy, resumption, same-socket HRR, fresh-authentication, cancellation and shared-budget regressions. Correct stale HRR cold-redial documentation.

Security refresh

The initial Go 1.27.1 / x/net 0.59 build was blocked after a fresh scan identified 11 reachable advisories published October 8. This final revision:

• Requires Go 1.27.2 and x/net v0.60.0; aligns CI, release configuration and all active Go builder image pins.
• Pins the published maintained uTLS commit ff869e255a305a8e722a14f6a090e49666cc5f78, including the exact upstream ECH decoder security backport and bounded regressions: fix: backport Go 1.27.2 ECH outer extension validation utls#2 . Its PR and post-merge Linux/macOS/Windows CI passed, including Linux race tests.
• Prevents floating CI toolchain selectors from selecting an older cached patch release or stale manifest entry via a >=1.27.2 <1.28.0 range and check-latest; exact minimum-version jobs remain pinned.
• Retains the new standard-library ReverseProxy CONNECT rejection; tests assert generic 502, zero upstream CONNECT requests and continued ordinary website/authenticated tunnel handling. No security guard is bypassed.

Final validation

Final head: b507a608f0d632e888110ae667b2ff6fd1e7364c, tree c4e32e4dd0d1828486dd5306d67ac3eff8574a6b. Local/Docker/remote tests used Go 1.27.2 and GOWORK=off. The final follow-up changes only CI toolchain selection; production/test sources and dependency graph are identical to validated tree 768eb0d1eedd01676c626a18f20dc0892d0e9005:

• make check passed: 24 dependency-boundary fixtures, module/notices checks, vet, all Go tests and release-recipe checks.
• All-package go test -race -shuffle=on -count=1 -timeout=5m ./... passed.
• Final govulncheck: zero reachable advisories and zero affected imported packages. One unused module-only advisory remains; this is not a claim that every module is vulnerability-free.
• Same Linux ARM64 test binary passed 13 targeted top-level groups three times each (39/39, no failures/skips), independently in isolated local Docker and on the authorized native ARM64 test host. Covers cold-wire fixture, real H2 reconnect/HRR/auth, TLS policy, H2 fallback, H3 wire/reconnect contracts and reverse-proxy Alt-Svc consistency.
• Test binary SHA-256: 0ef9508cddfaaf38b2eb7804b1f4c5fcb6ac3ba26d69dcc642cc029c55f79c8c.
• Independent review closed a GREASE-position normalization gap; no remaining blocking findings.

Evidence limits

The browser control is a historical independent cold-handshake capture, not a fresh browser session or a new PCAP campaign. Normalized cold ClientHello matching does not establish warm-browser equivalence, full H2/H3 traffic similarity, or passive-classifier resistance. H3 Chrome TLS resumption and 0-RTT remain disabled. No release tag is created.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.