feat: bump to Go 1.27.1, concurrent collection on all platforms, hardened executor

[christiangda]

Summary

Bumps the module to Go 1.27.1 and adopts what the release offers, fixes the issues found in a full code review, and refreshes the docs, README, CI action pins and Dependabot config. Prepares v0.2.0.

Generated IDs do not change. A side-by-side run of a build from main and this branch produced identical IDs for the default, -all, -vm, salted, MAC-all and -disk flag sets. CLI -all wall time dropped from 0.35s to 0.20s on macOS.

Toolchain and Go 1.27

• go 1.27.1 in go.mod; CONTRIBUTING, README and copilot-instructions say Go 1.27+.
• macOS installer and README now state macOS 13 Ventura as the minimum, which is the floor Go 1.27 supports.
• Go 1.27 stdlib adoption: uuid package for UUID validation, errors.AsType throughout tests and docs, strings.Cut / CutPrefix, sync.WaitGroup.Go, goroutine pprof labels (shown in tracebacks since 1.27), and a goroutineleak profile based test.
• go fix, the modernize analyzer and betteralign are clean for darwin, linux and windows. Tests also pass with GOEXPERIMENT=nojsonv2 (json v1 parity).

Library

• Shared concurrent collector (collect.go). All three platforms collect components in parallel, results are folded in declaration order so IDs and diagnostics are deterministic, and the duplicated Windows result-folding code is gone.
• Executor hardening. CommandError wraps context.DeadlineExceeded / context.Canceled when the context ended the command, cmd.WaitDelay bounds pipe waits after a kill, CommandError.Stderr carries the first stderr line, and a per-call memo executor lets macOS run system_profiler SPHardwareDataType once instead of three times.
• Windows. wmic is probed once (it was removed in Windows 11 24H2 / Server 2025) and PowerShell is used directly when absent. PowerShell always runs with -NoProfile -NonInteractive.
• UUID validation on all platforms via the stdlib uuid package: malformed, nil and max UUIDs fall through to the next source. Raw strings are still hashed.
• Provider hygiene. Diagnostics() returns a copy, WithExecutor(nil) is ignored, an already-cancelled context is refused before collecting, hashIdentifiers no longer mutates its input.

CLI

• Ctrl-C / SIGTERM cancel in-flight hardware queries.
• Package doc comment; the local uuid flag variable is renamed so it cannot shadow the new stdlib package.

Docs, CI, repo

• README rewritten. The first badge pointed at actions/workflows/main.yml, which does not exist; badges now reference pr.yml, release.yml and codeql.yml. Removed the Windows download instructions since no Windows binaries are published. Added a "what changes an ID" table.
• doc.go rewritten for the new behavior.
• Action pins bumped: checkout v7, setup-go v7, upload-artifact v7, download-artifact v8, cosign-installer v4, action-gh-release v3. dependabot.yml now also covers github-actions, grouped weekly.
• Removed the stale 4 MB machineid binary that was tracked at the repo root despite the .gitignore rule.

Open question for the reviewer

Four stability findings were not implemented because they rotate existing IDs on affected machines (this is a licensing library): Linux CPU flags line changes on kernel/microcode updates, ARM /proc/cpuinfo fields are not parsed, the virtual-interface list misses Hyper-V/WSL/awdl names, and removable disks count under WithDisk(). They are disclosed in the README stability table. Say the word and they ship together in a follow-up with a migration note.

Verification

• darwin: gofmt, build, vet, golangci-lint (0 issues), go test -race.
• linux and windows: go vet and go test -c compile; the suites run for the first time in this PR's CI.

🤖 Generated with Claude Code