* fix(deps): update golang.org/x modules to latest on the Go 1.25 line
Clears the x/crypto, x/net, x/sys and x/text vulnerability findings
reported against the pmg binary by image scanners.
Deliberately kept back: the go directive stays 1.25.1 because the Go
1.26 move is blocked on goproxy URL parsing (see #390), and grpc stays
pinned at v1.81.0 due to the trailers regression with v1.82.x.
* fix(container): move runtime base to debian 13 and refresh builder pin
The bullseye runtime base and the stale golang:1.25-bookworm digest
(go1.25.5) accounted for most of the vulnerability findings in the
published image. debian:13-slim is current stable and the refreshed
golang digest carries go1.25.12, covering every flagged stdlib CVE.
* feat: add macOS setup script for Jamf deployment
Adds scripts/pmg_setup_install.sh that installs/updates pmg (via
Homebrew or GitHub releases), runs pmg setup install, and optionally
enables cloud sync with credentials stored in macOS Keychain.
* feat: add --from-env flag to pmg cloud login
Allows non-interactive credential import from SAFEDEP_API_KEY and
SAFEDEP_TENANT_ID environment variables. Fails explicitly if either
is missing. Used by the setup script for Jamf deployments.
* refactor: use cloud.NewEnvCredentialResolver for --from-env
Use the dry library's env credential resolver instead of reading
env vars directly, keeping env var ownership in the shared library.
* update DRY
* update go to 1.25 back
