fix: correct clock ownership and LRU recency

[agkloop]

What changed

• Create the default ticker clock only after cache options pass validation.
• Treat clocks passed with WithClock as caller-owned, so one clock can be shared safely across caches.
• Keep the default clock and WithTickerClock clocks cache-owned and stopped by Cache.Stop.
• Make the last fluent clock option win when WithClock and WithTickerClock are combined.
• Refresh memory-store LRU recency on cache-engine fresh hits, including recency sampling.
• Update CI from Go 1.25.10 to patched Go 1.25.13 for vulnerability scanning.
• Update the API, production, performance, README, and agent documentation.

Why

Previously, memoize.New created a 1 ms ticker before applying options. Injecting another clock replaced the reference but left the default ticker goroutine running. Invalid cache construction could also leave that ticker behind. Cache.Stop then stopped the injected ticker instead of the hidden default ticker.

The memory fast path also returned fresh values without updating recency. A frequently read key could therefore be evicted even though memory.New documents exact LRU behavior.

The first CI run also exposed that the workflow used Go 1.25.10, whose standard library is affected by vulnerabilities fixed in Go 1.25.13. The tests were already passing; govulncheck was the failing step.

Behavior after this change

• WithClock is caller-owned and is not stopped by Cache.Stop.
• The default clock and WithTickerClock are owned by the cache.
• Fresh cache hits now protect recently used entries from LRU eviction.
• WithGetRecencySample still allows approximate recency when lower contention is preferred.

Validation

• GitHub verify workflow: passed
• CodeQL and GitGuardian: passed
• go test ./... -count=1: 161 tests passed in 16 packages
• go test ./... -race -count=1: 161 tests passed in 16 packages
• go vet ./...: passed
• Documentation and skill synchronization check: passed
• git diff --check: passed
• BenchmarkLRUHotHit remained at roughly 27-29 ns/op with 0 B/op and 0 allocs/op