examples: bump golang.org/x/net and x/image to v0.38.0 (#47)

Resolves all open Dependabot alerts, which were vulnerabilities in
transitive dependencies (golang.org/x/net, golang.org/x/image) pulled
in by the example module's older GUI libraries. Bumping these indirect
deps to v0.38.0 clears every advisory; the GUI libraries still compile
against them (all examples build). The published hotkey module is
unaffected — it only depends on golang.design/x/mainthread.

feat(darwin): unify all macOS hotkeys on CGEventTap, drop Carbon (#46)

* feat(darwin): unify all hotkeys on CGEventTap, drop Carbon

Replace Carbon RegisterEventHotKey with a single CGEventTap that serves
both regular hotkeys (matched by keycode + modifier flags, with keydown
de-dup and keyup tracking) and media keys (NSSystemDefined decode), and
consumes matched events. This removes the Carbon dependency and gives one
mechanism for everything.

Trade-off (intentional, see #45): a key event tap requires Accessibility
(Input Monitoring) permission, so now *every* macOS hotkey needs it, not
just media keys. Register returns an error (via AXIsProcessTrusted) when
untrusted. Because hosted CI runners cannot grant Accessibility, the
macOS hotkey test skips when the process is untrusted (axTrusted, exposed
to tests via export_darwin_test.go).

Towards #45.

* doc: note macOS Accessibility requirement for hotkeys

With all macOS hotkeys served by a CGEventTap, the application must be
trusted for Accessibility (Input Monitoring); document it in the README
platform notes alongside the package doc.

feat(darwin): media keys via CGEventTap (hybrid) (#44)

* feat(darwin): media keys via CGEventTap

Carbon RegisterEventHotKey cannot deliver media keys (play/pause,
next, previous, volume); they arrive as NSSystemDefined events. Add the
same KeyMedia*/KeyVolume* constants as the other platforms, encoded with
a mediaKeyBit sentinel over the NX_KEYTYPE_* code. register() routes
media keys to a CGEventTap that decodes the NSSystemDefined data1,
forwards keydown/keyup, and consumes the event; regular hotkeys keep
using Carbon (no permission required, keeps CI green).

CGEventTapCreate returns NULL without Accessibility/Input Monitoring
permission, surfaced as a Register() error. KeyMediaStop has no NX
equivalent and returns an error on macOS.

Towards #28.

* examples: add media key example; bump examples go directive to 1.24

A cross-platform example that registers the media/volume hotkeys and
prints their events, with platform notes (notably the macOS
Accessibility permission and how to grant it for a built binary).

Also bump examples/go.mod to go 1.24 to match the hotkey module (the
local replace pulls in its go 1.24 requirement).

* fix(darwin): reliably error when Accessibility is not granted

CGEventTapCreate can return a non-NULL but inert tap when the process is
not trusted for Accessibility, which would make Register succeed yet
never deliver events. Check AXIsProcessTrusted() up front and return the
permission error (via NULL) before creating the tap, so a missing grant
is always reported by Register rather than failing silently.

all: improve documentation

Fixes #17

all: adds more special keys (#14)

all: support keyup event (darwin)

Fixes #9

examples: add minimum

all: improve error message when CGO_ENABLED=0

all: bump to go1.17

- Use runtime/cgo
- Improve error message
- Retry on Linux
- Update workflow

Fixes #4

all: fix register on windows