[jwilder]

Summary

• Update Go to 1.27.3 in go.mod and the Docker builder, including version test fixtures.
• Update huandu/xstrings to 1.6.3 and shopspring/decimal to 1.6.0.
• Make the Docker build download modules and compile with -mod=readonly instead of modifying dependencies via go mod tidy.

Validation

• go test -race ./..., go vet ./..., go mod verify, and golangci-lint passed.
• Cross-builds passed for linux/amd64, linux/arm64, and darwin/amd64.
• govulncheck with Go 1.27.3 found no reachable vulnerabilities. It reports a module-level advisory for x/crypto/openpgp, which this project does not import.
• Docker image build was not run locally because the Docker daemon was unavailable.