fix(security): harden v0.1.0 release

[jamiesun]

Summary

• prepare the merged Agent-native inspection/plugin work for the v0.1.0 release
• raise the minimum toolchain to Go 1.25.10 and upgrade golang.org/x/crypto to v0.52.0
• add govulncheck as a required CI security gate
• reject symlinked remote observation roots before any managed child directory is created
• version the changelog, harden tag/release validation, and align release metadata with the Agent-native positioning
• bundle the matching SSHX Agent skill in every release archive and install it on Linux/macOS

Windows plugin runner parity is intentionally outside this release-hardening scope. Existing Windows binary builds remain unchanged.

Bugfix reflection

Bug class:
Remote cache path validation occurred after recursive directory creation; release builds also lacked a reachable dependency vulnerability gate.

Missing invariant:
No remote cache side effect may occur before every existing managed path component is proven to be a real directory, and release binaries must use a patched Go standard library and SSH dependency.

Why existing tests missed it:
Existing E2E covered reading a symlinked cache file, but not the first-write path with a symlinked managed root. CI ran gosec/CodeQL but not govulncheck.

Regression test added:
TestCLICacheWriteRejectsSymlinkedManagedRootBeforeCreatingChildren proves the outside directory remains untouched.

Docs or AGENT.md update needed:
Updated AGENT.md, CHANGELOG, README EN/CN, release guide, CLI identity, installer, and release metadata.

Verification run:

• Go 1.25.10 make check
• Go 1.25.10 go test -race ./...
• Go 1.25.10 E2E
• Go 1.25.10 make build-all
• golangci-lint
• govulncheck: 0 reachable vulnerabilities
• actionlint
• shellcheck
• mdbook build
• release archive and versioned changelog smoke tests