Bump proto companion to Go 1.27 (nix flake go_1_27 + flake.lock + amd64 republish)

[antoinetoussaint-byte]

Follow-up from #341 / #342 (Go 1.27 everywhere audit).

Context

The proto companion image (codeflydev/proto) is the last place still on Go 1.26. Unlike the go companion, this is cosmetic, not a correctness bug: proto's go is only used by swagger's gofmt to format generated output — proto never runs go build on a go 1.27.0 service, so it can't hit the toolchain not available failure that motivated #341.

Why it's not a one-line Dockerfile bump

• companions/proto/Dockerfile still says FROM golang:1.26-alpine, but that Dockerfile is a legacy --force-docker fallback. The image is actually built from companions/proto/flake.nix (Nix dockerTools), so its Go comes from nixpkgs, not the Dockerfile.
• nixpkgs' default go currently resolves to 1.26.5. pkgs.go_1_27 (1.27.0) exists.
• The flake has no flake.lock, so it floats on nixos-unstable and isn't reproducible despite the flake header claiming it is.

Proposed change

• In companions/proto/flake.nix, pin the runtime go in protoTools to go_1_27 (verified to evaluate + build).
• Commit a flake.lock so the image is actually reproducible.
• (Optional, for full consistency) bump the --force-docker Dockerfile builder stage to golang:1.27-alpine.
• Bump companions/proto/info.codefly.yaml to 0.0.13 and republish codeflydev/proto:0.0.13.

Blocker / sequencing

• The image must be published on linux/amd64 (proto has historically been amd64-only). It can't be produced from an Apple-Silicon dev machine whose nix linux-builder is aarch64-linux — the amd64 image-assembly derivations fail with a platform mismatch. Do this from amd64 CI (or an amd64 nix builder).
• Best done after fix: build a CGO-free CLI so companion publish links statically cli#456 merges, which fixes codefly companion publish so companion images can be published at all.

Until then, info.codefly.yaml should stay at 0.0.12 so codefly companion verify doesn't point at an unpublished tag.