build: drop GOPRIVATE — public modules use immutable proxy+sumdb

The Dockerfile set GOPRIVATE=luxfi/*,hanzoai/* which routes module
fetches 'direct' (git) and bypasses sum.golang.org. luxfi/hanzoai Go
modules are all PUBLIC; after a tag was force-republished, the git tag
content diverged from the immutable proxy/sumdb hash — so 'go mod
download' fetched bits that no longer matched the canonical, sumdb-correct
go.sum, failing image builds with SECURITY ERROR checksum mismatch.

Dropping GOPRIVATE resolves these modules through the default public
proxy + sumdb, yielding the canonical immutable hash that matches go.sum
and that a re-publish can no longer break. GITHUB_TOKEN insteadOf stays
for the direct fallback. go.sum re-tidied against the public sumdb is
byte-identical (already canonical); only the Dockerfile changes.

Dockerfile

@@ -5,7 +5,7 @@ RUN apk add --no-cache git ca-certificates
 
 ARG GITHUB_TOKEN
 RUN git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
-ENV GOPRIVATE=github.com/luxfi/*,github.com/hanzoai/*
+# No GOPRIVATE — public modules resolve via the immutable public proxy + sumdb.
 
 WORKDIR /app
 COPY go.mod go.sum ./