FIPS: support Go native FIPS 140-3 module (GOFIPS140) toolchains

Under FIPS_MODE=1, Makefile.build.mk probes boringcrypto and injects GO_BUILD_ENV=GOEXPERIMENT=boringcrypto, which cmd/go refuses to combine with GOFIPS140 — breaking builds on GOFIPS140 toolchains (CNG failure: https://gitlab.com/gitlab-org/build/CNG/-/jobs/15234386707).

Land !1296 (merged) (guard boringcrypto behind go env GOFIPS140 empty-or-off) — merged 2026-07-14
Bump labkit once its fips fix is released (stock labkit fails to compile with -tags fips on native toolchains) — landed via Renovate as labkit v1.64.9 in 652a82f2

Part of &22761 (closed) (spike: https://gitlab.com/gitlab-org/distribution/team-tasks/-/work_items/1706).

🤖 Generated with Claude Code

Edited Aug 21, 2026 by Jason Plum