kms: fetch the module graph through the proxy, not straight from git

github.com/hanzoai/cloud lost the v0.x tags it was published under — GitHub
carries v1.801.31 and nothing else — so GOPRIVATE, which implies GONOPROXY,
sent go mod download to a revision that is no longer there and build-amd64
died on "unknown revision v0.1.1". The proxy still holds it, and holds the
same bytes: the zip hashes to the h1: already in go.sum.

Dockerfile.kms-fetch never had the problem because its env assignments bind
to the git config they precede rather than to go mod download, so its graph
has always come through the proxy. Deleted there too, so both files read the
way they behave.

Dockerfile

@@ -22,12 +22,24 @@ COPY go.mod go.sum ./
 # Stage its go.mod/go.sum so `go mod download` can read the replaced module's
 # graph before the full source tree is copied.
 COPY sdk/go/go.mod sdk/go/go.sum ./sdk/go/
+# NO GOPRIVATE. Nothing in this graph is private, and GOPRIVATE implies
+# GONOPROXY — it forced every luxfi and hanzoai module to come straight from a
+# git remote. github.com/hanzoai/cloud no longer carries the v0.x tags it was
+# published under (GitHub holds v1.801.31 and nothing else), so a direct fetch
+# of the v0.1.1 this module requires answers "unknown revision" and the build
+# dies here.
+#
+# The proxy still serves v0.1.1 and serves the same bytes: its zip hashes to the
+# h1: already in go.sum, which go verifies on the way in. Surviving a tag that
+# vanished upstream is the whole reason the proxy exists.
+#
+# Dockerfile.kms-fetch has fetched this graph through the proxy all along — its
+# env assignments bind to the `git config` they precede, never to `go mod
+# download` — and that is the build that stayed green while this one broke.
 RUN --mount=type=cache,target=/go/pkg/mod \
     if [ -n "${GITHUB_TOKEN}" ]; then \
       git config --global url."https://x-access-token:${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"; \
     fi && \
-    GOPRIVATE="github.com/luxfi/*,github.com/hanzoai/*" \
-    GONOSUMDB="github.com/luxfi/*,github.com/hanzoai/*" \
     go mod download
 
 COPY . .

Dockerfile.kms-fetch

@@ -32,9 +32,13 @@ COPY go.mod go.sum ./
 # Stage its go.mod/go.sum so `go mod download` can read the replaced module's
 # graph before the full source tree is copied.
 COPY sdk/go/go.mod sdk/go/go.sum ./sdk/go/
+# The GOPRIVATE/GONOSUMCHECK that used to sit here bound to `git config`, not to
+# `go mod download`, so this graph has always come through the proxy — and that
+# is why this build kept working when Dockerfile forced a direct fetch of a
+# github.com/hanzoai/cloud tag that no longer exists. Deleted rather than
+# repaired: nothing here is private, and repairing it would have moved this
+# build onto the same missing tag.
 RUN --mount=type=cache,target=/go/pkg/mod \
-    GOPRIVATE="github.com/luxfi/*,github.com/hanzoai/*" \
-    GONOSUMCHECK="github.com/luxfi/*,github.com/hanzoai/*" \
     git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/" && \
     go mod download