* fix(deps): update golang.org/x modules to latest on the Go 1.25 line
Clears the x/crypto, x/net, x/sys and x/text vulnerability findings
reported against the pmg binary by image scanners.
Deliberately kept back: the go directive stays 1.25.1 because the Go
1.26 move is blocked on goproxy URL parsing (see #390), and grpc stays
pinned at v1.81.0 due to the trailers regression with v1.82.x.
* fix(container): move runtime base to debian 13 and refresh builder pin
The bullseye runtime base and the stale golang:1.25-bookworm digest
(go1.25.5) accounted for most of the vulnerability findings in the
published image. debian:13-slim is current stable and the refreshed
golang digest carries go1.25.12, covering every flagged stdlib CVE.
The build stage ran natively on $BUILDPLATFORM and make never received a
target arch, so both manifest variants shipped the same amd64 binary
(#379). Pass TARGETOS/TARGETARCH into the build with CGO_ENABLED=0 and
verify each platform variant runs 'pmg version' after push.
Fixes#379
Claude-Session: https://claude.ai/code/session_01E8yrxjqVw7454zByb8kxvD
Co-authored-by: Claude <noreply@anthropic.com>
