build: mark lux-private private, not all of luxfi

GOPRIVATE switches off the module proxy AND checksum verification together.
Covering github.com/luxfi/* meant every luxfi module was fetched straight from
git and trusted without verification — which is how moved tags got captured into
module caches and served from them indefinitely, making the same commit build on
one machine and fail on another.

Nearly all of luxfi is public and on proxy.golang.org, so it belongs under
normal verification. The private org is lux-private.

Twelve luxfi repos are still private AND still 404 on the proxy, so they are
listed individually rather than by wildcard — coverage now matches what actually
needs a direct fetch, and every other luxfi module is verified against
sum.golang.org again:

  bridge broker compliance erc20-go fasthttp graph hsm indexer
  mpc ordering password pool

The right end state is those repos moving to lux-private; until then the
explicit list keeps the exemption honest instead of blanket.

Co-authored-by: Hanzo Dev <[email protected]>

.github/workflows/release.yml

@@ -38,7 +38,7 @@ jobs:
       pre-build-command: |
         mkdir -p build
         export GONOSUMCHECK=github.com/luxfi/*
-        export GONOSUMDB=github.com/luxfi/*
+        export GONOSUMDB=github.com/lux-private/*
         export CGO_ENABLED=${{ matrix.image.cgo }}
         export CGO_CFLAGS="${{ matrix.image.cgo == '1' && '-O2 -D__BLST_PORTABLE__' || '' }}"
         if [ -f ${{ matrix.image.vm }}/main.go ]; then