build: bump Go to 1.27.2 and secrets-engine/client to v0.2.1

[Benehiko]

What I did

• Bumped github.com/docker/secrets-engine/client from v0.2.0 to v0.2.1. This also moves secrets-engine/x from v0.8.3 to v0.8.4.
• client v0.2.1 requires go >= 1.27.2, so this also bumps the go directive in go.mod, .go-version (used by CI) and GO_VERSION in the Dockerfile to 1.27.2.

client v0.2.1 checks that stored Docker Hub access tokens are JWTs. GetDefaultSession returns ErrInvalidAccessToken for a malformed token. That error wraps ErrNoSession, so isSessionUnavailable in internal/registry/desktop.go already falls back to the Docker CLI credentials.

Open question

Compose may need to stay on Go 1.26.x for a while. If so, this should wait until secrets-engine releases a client and x that support Go 1.26 again; the v0.2.1 bump of the go directive looks like a routine toolchain update rather than something the code needs. This PR is a draft until that's decided.

Testing

• go build ./... and golangci-lint run --build-tags e2e ./... pass.
• go test ./pkg/... ./internal/... ./cmd/... passes, except for three pkg/watch tests (TestGitBranchSwitch, TestWatchBrokenLink, TestWatchCountInnerFile). They fail the same way on main with Go 1.26.9 on macOS, so this change doesn't cause them.

AI disclosure

This PR was prepared by an AI coding agent (alki, running Claude) on the author's behalf. AI_AGENT_DISCLOSURE.md is included and must be removed after human review, before merge.

[docker-agent]

Assessment: 🟢 APPROVE

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Benehiko]

Added a second commit that removes jwtExpiry: compose no longer parses exp out of the access token itself. Docker Desktop's docker-auth store already fills in the claims, expiry included, from the JWT. It does this when saving a Hub credential (enrichHubCredential in pinata's internal/store) and when reading one from the legacy credential helper (mergeTokenPair in docker-auth). Together with the JWT check in client v0.2.1, Claims.ExpiresAt is the only expiry source compose needs. A session without an expiry claim is still reused for sessionTTL. (Comment posted by an AI agent on the author's behalf.)