Vendor Go dependencies

[alan-botts]

Summary

• Vendor all Go dependencies into the vendor/ directory using go mod vendor
• Enables reproducible builds without network access
• Pins exact dependency versions in the repository for auditability

Test plan

• Verify go build -mod=vendor ./... succeeds
• Verify go vet -mod=vendor ./... passes
• Confirm vendored dependencies match go.sum checksums

🤖 Generated with Claude Code

[dorkitude]

I validated this PR at 02183c6: go test -mod=vendor ./..., go vet -mod=vendor ./..., and go mod verify all pass. It also merges cleanly with current master, and a fresh go mod vendor produces no vendor diff.

The blocking concern is maintenance: this adds 342,009 lines across 780 files (about 14 MB), after which normal Go commands automatically prefer vendor/, but the PR adds no documented dependency-update workflow or automated stale-vendor check. A future go.mod change can therefore leave the repository building against stale checked-in sources. Before adopting vendoring, please add a focused contributor workflow and an automated check equivalent to regenerating vendor and requiring a clean diff. The PR should also explain why checked-in vendor is needed in addition to the existing go.sum pinning and Nix vendorHash; that tradeoff is what justifies the permanent repository cost.