Go 1.27 and encoding/json/v2: The Engine Changed, the Contract Didn't

go1.27rc1 replaces the engine under encoding/json with encoding/json/v2 internals, and existing callers will not notice: the v1 shims restore every v1 semantic, including two the v2 docs call security relevant. What moved is performance, split by payload shape and direction, and what moved is opt-in, behind an explicit import.