Fix spam decision boundary and update Go

[iamwavecut]

What changed

• correct the legacy casual-gaming example that contradicted the spam policy
• require an explicit listed spam signal instead of treating few-shot labels as a class prior
• narrow Unicode obfuscation to masked advertising or fraud and remove emoji-only classification
• add contrastive political and technical-conversation boundaries for both initial and reported checks
• update the Go toolchain and container builder from 1.25.12 to 1.25.13

Why

Gemini classified two benign messages as spam. The prompt contained a positive example with only an excited reaction and a number, had substantially more positive than negative examples, and treated broad Unicode or emoji patterns as standalone spam signals. These instructions could make benign short messages containing model names and version numbers resemble the mislabeled example.

The Go patch update is required because the release vulnerability gate now reports six reachable standard-library vulnerabilities in 1.25.12, all fixed in 1.25.13.

Verification

• red-green focused regression tests
• live Gemini smoke: four benign boundary cases returned 0; two real spam cases returned 1
• go test ./...
• go vet ./...
• go test -shuffle=on ./...
• go test -race ./...
• golangci-lint: 0 issues
• govulncheck: 0 reachable vulnerabilities under Go 1.25.13
• deployment configuration validation
• formatting, module, and whitespace checks