fix(ci): unblock Dependabot upgrades (test brittleness, gotestsum on Go 1.25)

[piotr-roslaniec]

Summary

Three open Dependabot PRs (#7, #10, #11) fail CI today against current main for reasons that aren't really about the bumps themselves — they're pre-existing fragilities that the bumps surface. This PR fixes those fragilities on main so the next Dependabot rebase lands cleanly.

What this fixes

1. `pkg/cmd/flag` tests use `reflect.DeepEqual` on errors

`flag_big_int_test.go:47` and `flag_wei_test.go:65` compare expected vs. actual errors via `reflect.DeepEqual`. pflag 1.0.7+ wraps underlying parse errors with `fmt.Errorf("...: %w", inner)`, producing a different concrete type even when the rendered message is identical. Result: tests fail with logs that look like

```
expected: invalid argument "100k" for "--amount" flag: failed to parse as big.Int: 100k
actual: invalid argument "100k" for "--amount" flag: failed to parse as big.Int: 100k
```

…where the two strings are byte-for-byte equal. Fixed by comparing `err.Error()` via a small `errorMessage(err)` helper. Unblocks #7 (pflag) and #10 (cobra, which transitively bumps pflag).

2. `fmt.Errorf` literals on `expectedError`

Pre-existing pattern: `expectedError: fmt.Errorf("...%s...", flagName)`. Replaced with `errors.New("..." + flagName + "...")`. Same string semantics, no format-string indirection, and stays clean of Go 1.24's vet 'non-constant format string' check for future test churn.

3. gotestsum v1.12.0 doesn't build on Go 1.25

`go install gotest.tools/gotestsum@v1.12.0` pulls `golang.org/x/tools@v0.19.0`, which contains:

```
internal/tokeninternal/tokeninternal.go:64:9: invalid array length -delta * delta (constant -256 of type int64)
```

This compiles on Go 1.24 but not on Go 1.25. As soon as any dep bump pushes `go.mod` past `go 1.24.0` (PR #11 forces `go 1.25.0` via x/time v0.15+), the `Install gotestsum` step fails. Bump to gotestsum v1.13.0, which pulls newer x/tools that compiles on both 1.24 and 1.25.

Unblocks #11 (x/time) and any future bump that nudges the Go floor.

Verification

Locally on this branch:

• `go vet ./...` clean
• `go build ./...` clean
• `go test ./pkg/cmd/...` green
• Smoke-tested with pflag 1.0.10: pkg/cmd/flag tests pass
• Smoke-tested with cobra 1.10.2 + pflag 1.0.9: pkg/cmd tests pass
• `go install gotest.tools/gotestsum@v1.13.0` installs cleanly on Go 1.24

After merge

Recreate the three open Dependabot PRs (`@dependabot recreate` on #7, #10, #11). All three should come back green.

Caveat on #11: it's not purely a library bump. `golang.org/x/time v0.15.0` requires `go 1.25.0` in go.mod, which cascades a Go-toolchain floor bump onto downstream consumers (same kind of cascade as #16's 1.18 → 1.24). Worth a separate sign-off before merging #11, even with this PR landed.

Test plan

• CI green on this branch
• After merge: `@dependabot recreate` on chore(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.10 #7, chore(deps): bump github.com/spf13/cobra from 1.8.1 to 1.10.2 #10, chore(deps): bump golang.org/x/time from 0.9.0 to 0.15.0 #11
• chore(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.10 #7, chore(deps): bump github.com/spf13/cobra from 1.8.1 to 1.10.2 #10 CI green; merge
• chore(deps): bump golang.org/x/time from 0.9.0 to 0.15.0 #11 — discuss Go 1.25 floor before merging