fix: production hardening (tok 0.1.0 CHANGELOG, trace panic, pin gosec/govulncheck, gosec enforcing)

Author: Race Tester

.github/workflows/ci.yml

@@ -131,12 +131,12 @@ jobs:
           cache: true
       - name: govulncheck
         run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
+          go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
           govulncheck ./...
       - name: gosec (advisory)
         continue-on-error: true
         run: |
-          go install github.com/securego/gosec/v2/cmd/gosec@latest
+          go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4
           gosec -exclude=G104,G301,G302,G304,G306 ./...
 
   # -------------------------------------------------------------------------

cli/checkpoint/id/id.go

@@ -41,10 +41,11 @@ func NewCheckpointID(s string) (CheckpointID, error) {
 
 // MustCheckpointID creates a CheckpointID from a string, panicking if invalid.
 // Use only when the ID is known to be valid (e.g., from trusted sources).
+// Returns an error if the input cannot be validated.
 func MustCheckpointID(s string) CheckpointID {
 	id, err := NewCheckpointID(s)
 	if err != nil {
-		panic(err)
+		panic(fmt.Errorf("invalid checkpoint ID %q: must be 12 lowercase hex characters", s))
 	}
 	return id
 }