v9.0.2

Security

• Bumped golang.org/x/crypto v0.50.0 → v0.52.0 (SSH stack advisories). SHIELD imports this first-party in both roles: client in the core, server in the agent.
• Raised the Go directive 1.25.5 → 1.25.12 (residual stdlib findings).
• Transitive: x/net 0.53.0 → 0.54.0, x/sys 0.43.0 → 0.45.0, x/term 0.42.0 → 0.43.0, x/text 0.36.0 → 0.37.0.

Improvements

• Added an SSH-channel probe (agent/xcrypto_probe_test.go) over the core→agent transport, pinning the negotiated KEX, host key algorithm, cipher and MAC as a drift gate.
• Exported core.DefaultLegacyAgentMACs so the probe reads the core's own list instead of a copy. No behaviour change.
• Negotiated crypto on the core→agent channel is unchanged from v9.0.1, confirmed by the probe.