chore(deps): bump Go to 1.25.10

[manusa]

Summary

Bumps the Go toolchain from 1.25.7 to 1.25.10 (latest 1.25 patch).

• native/go.mod: go 1.25.10
• .github/workflows/{build,release,snapshots}.yml: GO_VERSION: 1.25.10
• Makefile: xgo image bumped to ghcr.io/techknowlogick/xgo:go-1.25.10
• AGENTS.md: updated Go baseline reference

go mod tidy introduces no other changes.

Why not Go 1.26.x?

Initial attempt bumped to 1.26.3 (current latest stable) but make build-all and the native Windows build both fail at the link step:

ld: export_file.def:1: syntax error
ld: export_file.def: file format not recognized; treating as linker script

This is golang/go#78238 — a regression in Go 1.26's cmd/link/internal/ld/pe.go. peCreateExportFile emits a LIBRARY directive into the auto-generated .def file using filepath.Base(outopt) verbatim. When the basename contains multiple dots and hyphens (e.g. helm-windows-4.0-amd64.dll, which is xgo's hardcoded naming convention), GNU ld's DEF parser rejects it.

Verified workarounds and their problems:

• -extldflags '-Wl,--export-all-symbols' bypasses peCreateExportFile but blows past the PE 16-bit export ordinal cap (Helm's transitive symbol table is ~107k symbols).
• xgo's -out flag only sets the basename prefix; the -windows-$PLATFORM-$XGOARCH.dll suffix is hardcoded in its container's build.sh.
• A native cross-build (mingw-w64 on Linux) with -o helm.dll (no hyphens, single dot) builds cleanly under Go 1.26.3 and produces a correct PE export table — confirmed locally.

The cleanest path to 1.26.x is to remove xgo entirely and use native cross-compilers, which is now part of #393. Once that lands, the 1.26.x bump can be retried.

Upstream fix milestone: Go 1.27. No backport to 1.26.x announced.

Test plan

• go mod tidy clean (only the go directive moves)
• make test-go passes locally under 1.25.10 (two pre-existing envtest flakes unchanged)
• CI cross-platform build (make build-all) on Linux, native build on Windows/macOS

[manusa]

Closed by accident — a branch-rename API call delete-then-recreated the head ref after a force-push, which GitHub interprets as PR closure. Continued in #394.