v4.8.0 — staticcheck waived under Go 1.27.2

Mirrors baseline v4.8.0, Go 1.27.2 and a patch that outruns staticcheck, pinning baseline commit e7e378c.

The staticcheck gate is waived. Go 1.27.2 writes export data that staticcheck 2026.2.1, the newest release, cannot read (dominikh/go-tools#1832), so it checks no package that imports the standard library. The line is out of Makefile and verify.sh under a dated waiver in the README's Baseline deviations, as the baseline's operations/ci.md now rules, and verify.sh prints the waiver in its place. Every other gate runs, and the pin stays at 1.27.2. The line comes back with the staticcheck release that reads the new format.

Why the pin had to move. Under 1.27.1, govulncheck here reports twelve of 1.27.2's fifteen security fixes as called: both html/template escaper fixes through render, Range parsing through ServeContent and the static file server, and multipart header parsing through the upload handler. Under 1.27.2 it reports none.

make fmt fails when go fix does not converge. The loop used to exit 0 after three passes that still left a diff. verify.sh names the 1.27.2 pin in its go.mod check.

./verify.sh exits 0 over 79 gates, the staticcheck one printing its waiver, and make ci is green on this commit under Go 1.27.2.