fix: set go 1.25.0 and track go.sum for reproducible builds

- Set go directive to 1.25.0 (matches Docker golang:1.25-alpine)
- Track go.sum (empty — zero external dependencies for bootstrap)
- Fixes Docker build: COPY go.mod go.sum now finds both files

Co-Authored-By: Paperclip <noreply@paperclip.ing>

go.mod

@@ -1,3 +1,3 @@
 module github.com/elfoundation/hatch
 
-go 1.24.0
+go 1.25.0