fix(agent): disable seahorse context manager on freebsd/arm (#2417)

* fix(agent): disable seahorse context manager on freebsd/arm

Exclude freebsd/arm from the seahorse-enabled build and route it to the
unsupported stub implementation.

This avoids freebsd/arm build failures caused by modernc sqlite/libc while
keeping picoclaw buildable on that target.

* build: bump Go version from 1.25.8 to 1.25.9

* ci: install and run govulncheck directly in PR workflow

pkg/agent/context_seahorse.go

@@ -1,4 +1,4 @@
-//go:build !mipsle && !netbsd
+//go:build !mipsle && !netbsd && !(freebsd && arm)
 
 package agent
 

pkg/agent/context_seahorse_unsupported.go

@@ -1,4 +1,4 @@
-//go:build mipsle || netbsd
+//go:build mipsle || netbsd || (freebsd && arm)
 
 package agent