fix: production hardening (tok 0.1.0 CHANGELOG, trace panic, pin gosec/govulncheck, gosec enforcing)

[Patel230]

Production Readiness Fixes (9-May-2026)

• tok CHANGELOG — added ## [0.1.0] header and moved Unreleased content, now all ecosystem repos have consistent version docs
• trace:id/id.go — fixed bare panic, returning descriptive error via fmt.Errorf
• CI tooling — pinned govulncheck@v1.1.4 and gosec@v2.22.4 across all 11 repos; removed continue-on-error: true from eyrie gosec, making it an enforcing job

All 11 repos are now:
• Clean on main (no uncommitted/untracked changes)
• In sync with origin/main (0/0 ahead-behind)
• CI green on HEAD (including Scorecard where applicable)
• Version-consistent (0.1.0 project version, Go 1.26.4 toolchain)
• Properly integrated (hawk/external submodules aligned, cross-repo pins valid)

Ready for merge and promotion to production.

Required Checks

• CI workflow passes (all required jobs)
• Scorecard runs successfully (if applicable)
• Tags are present where needed (v0.1.0 / v0.1.0)
• Submodule alignment (hawk external already aligned)
• Security scanning passes (gosec now enforcing in eyrie)