chore: pin proto companion Go to 1.27 via nix flake (#343)

companions/proto/Dockerfile

@@ -1,7 +1,7 @@
 # Proto compilation companion for `codefly generate proto`.
 #
 # Size strategy:
-#   1. Multi-stage: build all the Go plugins in a golang:1.26-alpine
+#   1. Multi-stage: build all the Go plugins in a golang:1.27-alpine
 #      builder stage, copy only the static binaries into the runtime.
 #   2. Strip Go binaries with -ldflags="-s -w" during install — drops
 #      DWARF + symbol tables, typically 20-30% smaller per binary.
@@ -14,7 +14,7 @@
 
 # --- Builder stage: compile every Go plugin from source --------------
 
-FROM golang:1.26-alpine AS builder
+FROM golang:1.27-alpine AS builder
 
 RUN apk add --no-cache git python3 py3-pip nodejs npm protobuf
 

companions/proto/flake.nix

@@ -4,7 +4,7 @@
 #
 #   - Reproducible: Nix pins every transitive dependency by content
 #     hash via flake.lock. Two builds from the same commit produce
-#     bit-identical images. The Dockerfile pinned `golang:1.26-alpine`
+#     bit-identical images. The Dockerfile pinned `golang:1.27-alpine`
 #     and `apk add` package versions on a best-effort basis only.
 #
 #   - Layered cache: dockerTools.streamLayeredImage produces an image
@@ -136,8 +136,10 @@
           # Swagger client generator — needs `go` in PATH at runtime
           # to format its output, hence go below.
           go-swagger
-          # Bring `go`/`gofmt` for swagger's source formatter.
-          go
+          # Bring `go`/`gofmt` for swagger's source formatter. Pinned to
+          # go_1_27 to match the rest of the ecosystem (nixpkgs' default
+          # `go` still resolves to 1.26.x); only swagger's gofmt uses it.
+          go_1_27
           # Python grpcio-tools — for grpc_python_plugin et al.
           (python3.withPackages (ps: with ps; [ grpcio-tools ]))
           # protoc-gen-es, version-pinned to the ecosystem runtime (built