docker: let the tailscale builders fetch a newer toolchain

Both stages compile a tailscale tree cloned from an unpinned branch. The
golang images set GOTOOLCHAIN=local, so the moment upstream raises its go
directive the build fails outright instead of fetching a toolchain.

Dockerfile.derper

@@ -2,6 +2,12 @@
 
 FROM golang:1.27.1-alpine AS build-env
 
+# The builder pin is a floor, not a ceiling: this stage compiles a tailscale
+# tree cloned from an unpinned branch, which can raise its go directive at any
+# time. The golang images set GOTOOLCHAIN=local, which turns that into a hard
+# build failure rather than a toolchain fetch.
+ENV GOTOOLCHAIN=auto
+
 WORKDIR /go/src
 
 RUN apk add --no-cache git

Dockerfile.tailscale-HEAD

@@ -6,6 +6,12 @@
 
 FROM golang:1.27.1-alpine AS build-env
 
+# The builder pin is a floor, not a ceiling: this stage compiles a tailscale
+# tree cloned from an unpinned branch, which can raise its go directive at any
+# time. The golang images set GOTOOLCHAIN=local, which turns that into a hard
+# build failure rather than a toolchain fetch.
+ENV GOTOOLCHAIN=auto
+
 WORKDIR /go/src
 
 RUN apk add --no-cache git