Raise Go to the latest release, update dependencies, use the standard library uuid, add a vulnerability check (closes #102)

Go 1.27.1 in go.mod and in the Dockerfile's test and build images.
Every module go.mod requires is at its current release; protoc-gen-go
follows protobuf to v1.36.12 and mf.pb.go is regenerated. The standard
library uuid package replaces github.com/google/uuid; FromBytes could
only fail on a length validateUUID already checks, so that call and its
unreachable error are gone. make vulncheck runs govulncheck v1.8.0,
installed with go install at its release commit, in a vulncheck stage
of the Dockerfile; script/check does not run it. The newer go directive
switches on lint checks for strings.SplitSeq and t.Chdir, now used. A
new test pins the bytes of a seeded manifest written by an mfer built
before this change.

Model: opus-5-5

script/bootstrap

@@ -22,14 +22,15 @@ YARN_VERSION="1.22.22"
 # protoc v33.4, 2026-10-04, for script/generate. The sha256 of each
 # platform's release archive is in ensure_protoc.
 PROTOC_VERSION="33.4"
-# gofumpt v0.12.0 for script/gofumpt and protoc-gen-go v1.36.11 for
-# script/generate, 2026-10-04: each is installed into bin/ with
-# `go install`, pinned to the commit its release tag names. Those two
+# gofumpt v0.12.0 for script/gofumpt, 2026-10-04, and protoc-gen-go
+# v1.36.12 for script/generate, 2026-10-06: each is installed into bin/
+# with `go install`, pinned to the commit its release tag names. Those two
 # scripts refuse any other version, so a new pin is changed there too.
+# protoc-gen-go stays at the google.golang.org/protobuf version in go.mod.
 GOFUMPT_VERSION="v0.12.0"
 GOFUMPT_COMMIT="3e07e7e70ac93761d8e79ca0083a19e3d59f753d"
-PROTOC_GEN_GO_VERSION="v1.36.11"
-PROTOC_GEN_GO_COMMIT="96a179180f0ad6bba9b1e7b6e38d0affb0168e9a"
+PROTOC_GEN_GO_VERSION="v1.36.12"
+PROTOC_GEN_GO_COMMIT="cdd4c5f7406e82462949c7a65defa9f3029c162d"
 
 PKGMGR=""
 SUDO=""

script/generate

@@ -15,7 +15,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # in the mf.pb.go header.
 PROTOC_VERSION="33.4"
 PROTOC="$ROOT/bin/protoc/bin/protoc"
-PROTOC_GEN_GO_VERSION="v1.36.11"
+PROTOC_GEN_GO_VERSION="v1.36.12"
 PROTOC_GEN_GO="$ROOT/bin/protoc-gen-go"
 
 # sha256 <file>: print "<hash>  <file>", with sha256sum, or with shasum

script/vulncheck

@@ -0,0 +1,22 @@
+#!/bin/sh
+# script/vulncheck: report known vulnerabilities in the code mfer calls,
+# with govulncheck, which reads the Go vulnerability database online.
+# It runs as the vulncheck stage of the Dockerfile, on the same Go as the
+# test phase, and this builds that stage alone, on the same terms as
+# script/lint and script/test.
+#
+# script/check does not run it: the gate's result depends on this tree
+# alone, and this one changes whenever a new advisory is published.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build --no-cache \
+        --target vulncheck \
+        -t "$("$SCRIPT_DIR/projectname")-vulncheck" .
+}
+
+main "$@"