fix(build): unpoison luxfi/age go.sum + first-party-scoped sumdb skip

luxfi/age v1.5.0 was re-pointed to a newer commit; sum.golang.org pins
the first-seen hash immutably, so a fresh build fetching our own module
hit `verifying github.com/luxfi/age@v1.5.0: checksum mismatch · SECURITY
ERROR`.

- go.sum: re-record age v1.5.0 zip h1: to live content (G69Hb… → zC/Fw…);
  /go.mod hash was unchanged.
- Dockerfile: add explicit GONOSUMDB scope (first-party only) and drop the
  fragile `rm -f go.sum && go mod download` self-heal — it masked the stale
  go.sum and re-recorded unverified hashes on any transient error. Correct
  committed go.sum + GOPROXY=direct is the one durable way.

Never global GONOSUMDB=* / GOINSECURE. Root cause is the upstream
force-re-tag practice, which must stop.

Dockerfile

@@ -3,24 +3,28 @@ RUN apk add --no-cache ca-certificates tzdata git
 RUN addgroup -g 65532 -S nonroot && adduser -u 65532 -S nonroot -G nonroot
 WORKDIR /src
 # Private cross-org subsystem modules (hanzoai/*, luxfi/*, zap-proto/*) are
-# fetched via authenticated git. GOSUMDB=off + GOPROXY=direct tolerate
-# force-re-tagged luxfi/hanzoai modules (committed go.sum is source of truth);
-# gh_token is the shared docker-build.yml BuildKit secret (no-op when absent).
+# FIRST-PARTY (we own them; now public on GitHub) and fetched directly via
+# authenticated git. GOPRIVATE marks them; GOPROXY=direct routes them straight to
+# git (never the public proxy, which serves a tag's FIRST-seen content that
+# sum.golang.org pins immutably — stale after any tag re-point); GONOSUMDB skips
+# the public sumdb for them ONLY. First-party-scoped, NEVER global GONOSUMDB=* /
+# GOINSECURE. The committed go.sum (re-recorded to live content) is the single
+# source of truth. gh_token is the shared docker-build.yml BuildKit secret.
 ENV GOPRIVATE=github.com/hanzoai/*,github.com/luxfi/*,github.com/zap-proto/* \
+    GONOSUMDB=github.com/hanzoai/*,github.com/luxfi/*,github.com/zap-proto/* \
     GOSUMDB=off \
     GOPROXY=direct \
     GOFLAGS=-mod=mod
 COPY go.mod go.sum ./
-# go mod download, self-healing past upstream force-re-tag poisoning: if a
-# luxfi/hanzoai module's tag was force-moved/deleted after go.sum was recorded,
-# the committed sum mismatches the fresh origin fetch. With GOSUMDB=off the
-# regenerated sum is trustworthy for our own private modules. Root-cause fix is
-# stopping force-re-tags at the source; this keeps the image buildable meanwhile.
+# With go.sum recorded against live tag content and our orgs routed direct, this
+# verifies cleanly — no runtime go.sum regeneration. (The old `rm -f go.sum`
+# self-heal masked a stale go.sum and silently re-recorded unverified hashes on
+# ANY transient error; removed in favor of a correct, committed go.sum.)
 RUN --mount=type=secret,id=gh_token \
     if [ -s /run/secrets/gh_token ]; then \
       git config --global url."https://x-access-token:$(cat /run/secrets/gh_token)@github.com/".insteadOf "https://github.com/"; \
     fi && \
-    (go mod download || (echo ">> go.sum poisoned by upstream force-re-tag; regenerating from origin" && rm -f go.sum && go mod download))
+    go mod download
 COPY . .
 RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /cloud ./cmd/cloud
 

go.sum

@@ -1179,7 +1179,7 @@ github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 h1:PwQumkgq4/acIi
 github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
 github.com/luxfi/accel v1.1.9 h1:Tsk6gXj2uKE19501bD0ajRYdeCHIlTGb6jYyLc+F8hc=
 github.com/luxfi/accel v1.1.9/go.mod h1:K00BcnLzEYMPHwCFq8Tf/450ApmTs9xBVvYOnofJCkc=
-github.com/luxfi/age v1.5.0 h1:G69HbSV4R3vKEH9B0CulnRaMdSdf4RalMgP8xKmxHeI=
+github.com/luxfi/age v1.5.0 h1:zC/Fw/ptZwAXr9nqrxmrcf8752EIl1Lq9RECp9OmCO0=
 github.com/luxfi/age v1.5.0/go.mod h1:iAYAxgvrXxcy746+Ovh/eWWDuF9teJLNcCSSOX9RYW0=
 github.com/luxfi/atomic v1.0.0 h1:xUV60MuzRvXngaQ1sM0yVC2v4TRoLlUGkkH7M9PS4yw=
 github.com/luxfi/atomic v1.0.0/go.mod h1:0G2mTlQ6TXWHICUHrUUPu1/qAiIyR4gSZ2tva9ci/bI=