fix: bump go toolchain to 1.25.12 for the crypto/tls advisory

[pavelmaksimov25]

Summary

Bumps the pinned Go toolchain from 1.25.11 to 1.25.12 to clear the standard-library advisory GO-2026-5856 (crypto/tls), which govulncheck reports as reachable from the running server and CLIs:

• internal/platform/github/client.go — GetPullRequest → http.Client.Do / io.ReadAll → tls.Conn handshake/read
• internal/diagnostics/application/config_cli.go — List → fmt.Fprintf → tls.Conn.Write

The pin is updated in the three places that carry it: go.mod, justfile (the Docker govulncheck image), and .github/workflows/ci.yml (GO_VERSION).

Notes

Toolchain-only change — no application code touched. Verified with the Docker govulncheck step (just vuln) on 1.25.12: No vulnerabilities found; go build ./... clean.

Kept as its own single-concern PR so the advisory can be cleared on main independently of the in-flight routing fix (#173) and AI feature (#175), both of which will rebase onto this.

[github-actions]

🐳 Beta image published: ghcr.io/mptooling/notifycat:pr-176 — rebuilt on every push, removed when the PR closes.

docker pull ghcr.io/mptooling/notifycat:pr-176

Built from a80f4d8.