[dependabot:release-train-updater] Routine Go module freshness bump for github/gh-aw-mcpg (segmentio/asm, spf13/pflag)

Two indirect Go module dependencies in `github/gh-aw-mcpg` have newer patch releases available. No security advisories apply (`govulncheck` reports "No vulnerabilities found").

**Action:** A maintainer with write access to `github/gh-aw-mcpg` should review the attached review bundle artifact and open the equivalent PR there (this control-plane repo runs in `review` mode and cannot push to the target repo directly). Acceptance check: `go build ./...`, `go vet ./...`, and `go test ./...` all pass after applying the diff.

### What changed
- Manifests: `go.mod`, `go.sum`
- `github.com/segmentio/asm` (indirect, via `segmentio/encoding`): v1.1.3 → v1.2.1
- `github.com/spf13/pflag` (indirect, via `spf13/cobra`): v1.0.9 → v1.0.10
- Update type: patch, transitive-only, no source-code changes required

### Why now
Routine freshness lane. These are the only two dependencies in `go.mod` with newer versions per `go list -m -u all`. All other outdated versions belong to deep transitive packages not declared in `go.mod` and were excluded to keep the change minimal.

### Validation performed (in this workflow's checkout of the target repo)
- `govulncheck ./...` → No vulnerabilities found
- `go build ./...` → success
- `go vet ./...` → success
- `go test ./...` → all 14 packages passed

### Risk
Low. Both packages are reached only transitively (no direct imports in repo source). No auth/crypto/payment/serialization surface touched.

Full patch and notes

The complete `go.mod`/`go.sum` diff, validation log, and summary have been published as a review-bundle workflow artifact (bundle: `go-mod-freshness`, target: `github/gh-aw-mcpg`, base: `main` @ `238ee8a`).

### Control Plane
- Correlation ID: 33848603472-34
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33848603472

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/33848960488) · copilot · auto · 48.1 AIC · ⌖ 7.73 AIC · ⊞ 20.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 18, 2026, 7:40 AM UTC

Review the attached `go-mod-freshness` bundle for the `github/gh-aw-mcpg` target, then apply its `go.mod` and `go.sum` changes there. Confirm completion with `go build ./...`, `go vet ./...`, and `go test ./...`; the issue reports all three passing in the workflow checkout.

Written by the indexing model from the issue text.