build!: retire the fips-strict variant, verify the Go toolchain, label what each image contains

The fips-strict-debug variant carried a patch that worked around golang/go#78178: under GODEBUG=fips140=only, Go 1.24 through 1.26.2 offered X25519MLKEM768 in FIPS mode and then refused its X25519 half, so every FIPS image died on the first registry pull. Go 1.27 fixes this and 1.26.3 carries the backport. This MR moves the toolchain to 1.27.0, retires the variant the fix makes redundant, adds a regression guard so the bug cannot return unnoticed, verifies the Go toolchain download, and labels every image with the upstream it was built from.

Changes

• The fips-strict variant is retired: patches/, the seventh build and its sign, SBOM, attest and verify jobs are gone. Six variants remain. Go documents fips140=only as a test and debug mode, and the plain FIPS images now pass under it.
• fips-only-smoke runs the plain FIPS image under GODEBUG=fips140=only, must succeed, and fails with a named message if the X25519 refusal ever reappears. fips-smoke now sets and asserts fips140=on.
• The Go tarball is checked against the SHA256 published at go.dev before unpacking. Checksums sit beside GO_VERSION in .gitlab-ci.yml and as ARG defaults in the Dockerfiles. A Go bump is now a human step, and the Renovate rule says so.
• Labels io.gitlab.public-sector.kaniko.upstream and upstream_version on every image, so a mirrored image identifies its fork and tag.
• Examples pin v1.25.19-*, the tag the next release carries. The v1.25.14-* tags they referenced were never published.
• Go 1.25.7 to 1.27.0 and pipeline catalog v6.0.0 to v6.2.1, superseding !19 (closed) and !24 (closed). The nine consumed component spec: blocks are byte-identical across the two catalog versions.
• Favicon path on the docs site, a comment that wrongly said ARGs become labels, a comment overstating container-scanning coverage, .claude/ ignored, and the agent notes aligned with the six-variant build.

Evidence

A probe matrix over published images: every image built on Go 1.25.7 (v1.0.2 and latest, plain and strict) refuses under fips140=only with crypto/ecdh: use of X25519 is not allowed in FIPS 140-only mode; both images from this branch on Go 1.27.0 complete the build. hadolint and glab ci lint are clean. This MR's pipeline builds the six variants, runs both smoke jobs, and signs and attests as before.

Out of scope

• Documentation and SECURITY.md corrections follow in a second MR, including removal of the strict variant from README, site, and SECURITY.md.
• Container scanning still covers -fips-debug only. Covering all six needs one scan job and one summary include per variant, because the template hardcodes its report filename.
• docker:pinDigests stays off. The estate Renovate preset disables it deliberately, and a consumer repo should not override that.
• The per-commit registry tags are for the catalog's registry-cleanup component.

Release: v1.25.19 is cut after the documentation MR lands, mirroring the upstream tag this build tracks.