ci: download Go modules in functional setup; F15/F16 inherit the module cache

[yabinma]

Moves the functional job's Go module fetch out of the tests and into a fail-closed setup step.

Motivation: the first main run after #1 (35921329256) failed in the functional job. The failure was 1 test out of 904: F16's go test subprocess got INTERNAL_ERROR from proxy.golang.org while downloading k8s.io/kube-openapi. The re-run passed.

• Setup step: functional gains step 8, exactly go mod download. It is unconditional and has no env. A proxy failure now fails setup before pytest starts.
• F15/F16 tests: they inherit the job's module cache. The four GOMODCACHE=/tmp/go-mod fallbacks are removed.
• README: documents the jailed-run cache contract.
• Manifest pins:
  • The closed go grammar admits exactly go mod download.
  • The GO*/CGO* env-key bans are unchanged, with no allowlist and no special case.
  • The prefetch sits before the A10(v) hygiene gate, and the hygiene gate stays adjacent to pytest.
  • 24 drift fixtures cover the new step.
• Fail-closed test: go mod download with GOPROXY=off on an empty cache exits non-zero with a module-proxy refusal.

The design, audit and code review are all approved.

🤖 Generated with Claude Code