FIPS: adopt Go's native FIPS 140-3 module (GOFIPS140) toolchain

Replace the golang-fips toolchain with upstream Go + GOFIPS140=v1.0.0 (CMVP certificate 5247) baked into the FIPS toolchain image's go.env; dual-chain-safe runtime posture.

• Land !3010 once the upstream Makefile guards and labkit fix merge (FIPS pipeline currently fails on exactly those four components) — FIPS pipeline fully green 2026-08-20 (pipeline 2773684237, zero failed jobs); MR marked ready
• Protect pre-cutover -fips/-build-fips registry tags from cleanup until the chain is proven — verified 2026-08-20: the project has no container expiration policy and no CI registry-deletion jobs (only buildx builder cleanup); pre-cutover tags face no automated deletion. Re-check if a cleanup policy is ever introduced.
• Retire renovate-gitlab-bot rules for GO_FIPS_VERSION/GO_FIPS_TAG; consider automation for GO_FIPS140_MODULE_VERSION bumps
• Follow-up decision: escalate runtime posture to GODEBUG=fips140=only (QA-backed; object-storage/MD5 paths), including entrypoint-bypassing images (kas/agentk/zoekt) Do not use GODEBUG=fips140=only.

Part of gitlab-org&22761 (spike: https://gitlab.com/gitlab-org/distribution/team-tasks/-/work_items/1706).

🤖 Generated with Claude Code