Build on Go 1.27.1, and give each test IAM an address of its own

zip v1.37.43 needs Go 1.27.1, which the 1.26.8 builder image refused,
so v1.5.105 published no image.

TestOrgAdminSchemaAuthority answered a member 401 on the runner: the
JWKS cache keys a document by its address, and a closed test server's
port is soon another test's, so a token was checked against the last
IAM's keys. tests.IAM serves its keys under a path of its own.

Dockerfile

@@ -6,7 +6,7 @@
 # binary at compile time (ui-react/embed.go uses //go:embed all:dist).
 # The committed ui-react/dist is the source of truth for CI builds —
 # rebuild it locally with `pnpm --dir ui-react build` before tagging.
-FROM public.ecr.aws/docker/library/golang:1.26.8-alpine AS builder
+FROM public.ecr.aws/docker/library/golang:1.27.1-alpine AS builder
 RUN apk add --no-cache git ca-certificates tzdata
 WORKDIR /build
 # Every module in this graph is public, so the download is the proxy verified

hanzo.yml

@@ -11,7 +11,7 @@
 # them, so `go vet` had been failing on `main` and nobody could see it.
 
 # Tests run DIRECTLY on the runner, not inside the image build, and hanzoai/ci
-# provisions the toolchain from go.mod (1.26.8) plus a C compiler.
+# provisions the toolchain from go.mod plus a C compiler.
 #
 # CGO_ENABLED=0 ON EVERY GATE, because that is how Base ships — the Dockerfile
 # builds `CGO_ENABLED=0` and the pure-Go modernc SQLite that comes with it. With

tests/iam.go

@@ -48,7 +48,10 @@ func NewIAM(t testing.TB) *IAM {
 	}))
 	t.Cleanup(ts.Close)
 
-	return &IAM{URL: ts.URL, key: key}
+	// A process caches a JWKS document by its address, and a closed test
+	// server's port is soon another's: two IAMs at one address would read each
+	// other's keys. A path of its own keeps every IAM's address its own.
+	return &IAM{URL: ts.URL + "/" + rand.Text() + "/jwks", key: key}
 }
 
 // Token signs claims, valid for the next hour.