Fix framework load precedence and gosec failure

[davidahmann]

Summary

• make framework.Load resolve embedded starter frameworks before probing local files for non-path inputs
• preserve runtime filesystem loading for explicit paths and non-embedded filename fallback
• add regression tests to prevent local-file collisions from overriding embedded built-ins
• annotate LoadFile with a scoped #nosec G304 justification for intentional caller-provided local YAML loading

Why

• fixes deterministic behavior regression where local eu-ai-act.yaml could affect proof frameworks list
• fixes gosec failure from run 22164193188

Validation

• go test ./...
• go vet ./...
• gosec ./...