revert: bump speakeasy-core/client-sdk-go (#2117) — restores registry auth

[AshGodfrey]

Why

CLI v1.795.2 breaks speakeasy tag promote for customers using registry tagging in CI:

Error: {"message":"err_unauthorized: unauthorized -- bearer token missing","status_code":403}
Error: failed to tag registry images: error running speakeasy tag: ... speakeasy tag promote

This is not a security exposure — the server still enforces auth (MustHaveConsistentWorkspaceIDClaimHTTP). It's a spec/codegen defect: the client stopped sending credentials.

v1.795.1..v1.795.2 changes only go.mod/go.sum, and the operative line is speakeasy-client-sdk-go/v3 v3.26.7 -> v3.27.0.

What broke

v3.27.0 was the first regeneration of that SDK since 2025-05-06. It picked up a registry spec defect live since March: openapi_artifacts.yaml and openapi_subscriptions.yaml declare no top-level security, so once speakeasy merge began pushing global security down onto individual operations (#1952, registry#4559), their 13 operations composed as security: [].

The generated SDK therefore dropped utils.PopulateSecurity from all 11 Artifacts and both Subscriptions operations.

Verified against a local test server, identical calling code:

Operation	v3.26.7	v3.27.0
Artifacts.PostTags	X-Api-Key sent	no auth header
Artifacts.GetRevisions	X-Api-Key sent	no auth header
Workspaces.Get (control)	X-Api-Key sent	X-Api-Key sent

Affected CLI paths: registry/tagging.go -> Artifacts.PostTags (powers tag promote, tag apply, ci tag) and internal/remote/sources.go:153 -> Artifacts.GetRevisions.

This went unnoticed for five months because the other consumers (webapp, admin SDK) authenticate via credentials: 'include' cookies, so a missing security parameter is invisible to them. The header-authenticated public Go SDK was frozen by a broken regen since May 2025 — so it kept shipping correct pre-March code until now.

Why revert rather than fix forward

• Customers tracking speakeasyVersion: latest pick this up automatically; the breakage is spreading.
• The real fix spans three repos (registry spec -> SDK regen -> CLI bump) and can't land quickly.
• build: bump speakeasy-core to capture the registry license token #2117 was explicit groundwork — "No behaviour change in this PR" — and what it enables (openapi-generation#55) is still open, so this gives up no live functionality.

Verification

• go build ./... — clean
• go test ./registry/... ./pkg/merge/... — pass
• Resolved deps back to client-sdk-go v3.26.7 / speakeasy-core v0.22.2; all 11 PopulateSecurity calls restored

Follow-up

1. Cut v1.795.3 — the revert only helps once released.
2. Add top-level security to openapi_artifacts.yaml + openapi_subscriptions.yaml in speakeasy-registry. openapi_admin.yaml has the same defect (36 ops, no impact today).
3. Re-land build: bump speakeasy-core to capture the registry license token #2117 on a fixed v3.27.1.
4. Consider a warning in pkg/merge when setExplicitNoSecurity marks operations unsecured — it silently performs a security-downgrading transform, which is what let this ship.

🤖 Generated with Claude Code

---

Summary by cubic

Reverts the bump to speakeasy-client-sdk-go and speakeasy-core to restore registry auth. v3.27.0 stopped sending the X-Api-Key on registry operations, breaking speakeasy tag promote; reverting to v3.26.7 reinstates auth headers and fixes CI tagging.

• Downgrades speakeasy-client-sdk-go/v3 to v3.26.7 and speakeasy-core to v0.22.2, restoring PopulateSecurity on Artifacts/Subscriptions operations.
• Affected commands (speakeasy tag promote, tag apply, ci tag) send X-Api-Key again; no other behavior changes. Release this as v1.795.3 so customers on speakeasyVersion: latest regain working registry tagging.

^{Written for commit ffc8e4c. Summary will update on new commits.}