btcd v0.27.0

This release contains protocol validation fixes, a lower-allocation transaction decoder, RPC reliability fixes, and updated build dependencies. The release archives were built with Go 1.27.3.

Protocol, transactions, and cryptography

• Replace the fixed 4 MiB script slab with a tiered arena allocator and bounded decode staging (#2565).
• Reject an empty P2WSH witness and SIGHASH_SINGLE signing without a matching output (#2599, #2625).
• Align signature opcode validation, fix Taproot multi_a PSBT finalization, and reject inconsistent input UTXOs and invalid derived keys, #2601, #2611).
• Fall back to Base58 address parsing after Bech32 fails and refresh the MuSig2 BIP 327 test vectors (#2631, #2628).

RPC and operations

• Fix a getblock RPC panic and test null verbosity handling (#2600, #2605).
• Add RPC client cookie parsing tests and fix RPC, Tor, and cross-build behavior while updating dependencies (#2562, #2627).

Builds and release

• Vendor anet from its maintained source, upgrade the release toolchain to Go 1.27.3, and prepare the 0.27.0 versions and nested module tags (#2554, #2654, #2656).

Contributors: @allocz, @fametrano, @grandpig, @Roasbeef, @starius, @vbrekher, and @yyforyongyu.

The v0.27.0 source tag and release manifest are signed with Olaoluwa Osuntokun's key, fingerprint A5B6 1896 952D 9FDA 83BC 054C DC42 612E 8923 7182. Verify the manifest with gpg --verify manifest-v0.27.0.txt.sig manifest-v0.27.0.txt, then compare archive SHA-256 hashes with the manifest. Rebuild from the tag using Go 1.27.3 to check reproducibility.

Full changelog: v0.26.2...v0.27.0