fix(ci): build on Go 1.25 to clear GO-2026-4602 in govulncheck

The govulncheck CI job flagged GO-2026-4602 (FileInfo can escape from a
Root in os), reachable via config.discoverRepos → filepath.WalkDir →
os.ReadDir. It's fixed in the Go 1.25.8 standard library, but CI built
with 1.24.13.

- bump setup-go to "1.25" in ci.yml (build + security) and release.yml
  so the scan and released binaries use the patched stdlib
- bump go.mod and README to Go 1.25

Author: ashishxcode

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.24"
+          go-version: "1.25"
       - run: gofmt -l cmd internal | tee /dev/stderr | (! read)
       - run: go vet ./...
       - run: go build ./...
@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.24"
+          go-version: "1.25"
       # Scan dependencies and our own code for known Go vulnerabilities.
       - name: govulncheck
         run: |

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.24"
+          go-version: "1.25"
 
       - name: Build cross-platform binaries
         run: make release

README.md

@@ -25,7 +25,7 @@ For a window you choose, it gathers **everything you did**:
 
 ## Install
 
-### Option 1 — `go install` (needs Go 1.24+)
+### Option 1 — `go install` (needs Go 1.25+)
 
 ```bash
 go install github.com/ashishxcode/commit-chronicle/cmd/commit-chronicle@latest

go.mod

@@ -1,6 +1,6 @@
 module github.com/ashishxcode/commit-chronicle
 
-go 1.24.2
+go 1.25.0
 
 require (
 	github.com/charmbracelet/bubbles v1.0.0