fix(brand): propagate AgentAuth reference cleanup + Go toolchain bump to main

[devonartis]

Summary

Promotes the work landed on develop since 2026-04-20 to main. Net behavior change for end users: stale AgentAuth surfaces now read AgentWrit, TLS compose overlays mount the path the cert generator actually writes to, and govulncheck-flagged stdlib CVEs are gone after a 1.25.9 → 1.25.10 toolchain bump.

What's propagating

• fix(brand) — current AgentAuth text surfaces renamed to AgentWrit in cmd/, internal/, README, docs/python-sdk, .gitignore, .golangci.yml, contribution-policy workflow, and scripts/gates.sh header. Historical CHANGELOG entries and the watchdog regexes at scripts/gates.sh:126 + .github/workflows/ci.yml:117-118 were preserved intentionally.
• fix(tls) — docker-compose.tls.yml and docker-compose.mtls.yml now mount /tmp/agentwrit-certs, matching scripts/gen_test_certs.sh. Operator-visible runtime behavior change for anyone running the TLS overlays.
• test(sec-l2b) — setup files updated, S2 + S3 evidence re-recorded against a live broker (real EdDSA JWT, RFC 7807 401, request IDs — not find-and-replace).
• docs(changelog) — new [Unreleased] block recording the rebrand cleanup; zero historical lines deleted.
• chore(ci) — Go toolchain 1.25.9 → 1.25.10 so govulncheck stops failing on stdlib CVEs.

Two earlier commits also tag along from 2026-04-23 — a justfile add and its same-day revert. Net diff vs main on justfile: empty.

Verification trail

• PR fix(brand): clean up remaining AgentAuth references #79 (fix/agentauth-reference-cleanup → develop): 20/20 CI checks green before merge
• Independent post-impl review by pr-review-toolkit:code-reviewer: APPROVE on all 7 verification items (strict post-grep, watchdog regex preservation, TLS compose parity, S2/S3 evidence integrity, CHANGELOG history untouched, CI 20/20, no unrelated drift)
• Post-merge CI on develop (c90803c): CI + CodeQL both SUCCESS

Test plan

• All CI checks green on this PR
• After merge: spot-check that awrit --help and broker startup banner read "AgentWrit"
• After merge: spot-check that docker-compose.tls.yml mounts /tmp/agentwrit-certs
• After merge: confirm govulncheck workflow stays green on main