build: drop GOPRIVATE — public modules use immutable proxy+sumdb

The dex Docker builds set GOPRIVATE over our orgs, which routes those module
fetches `direct` (git) and bypasses sum.golang.org. After luxfi tags were
force-republished (e.g. luxfi/[email protected], luxfi/[email protected]) the git tag content
diverged from the immutable proxy/sumdb hash, so a `direct` fetch pulled bits
that no longer matched the canonical go.sum — failing image builds with a
checksum mismatch (or poisoning go.sum to the moved bits).

Resolving through the default public proxy + sumdb yields the canonical
immutable hash that matches go.sum and that a re-publish can no longer break —
the same model already adopted by lux/kms.

Supersedes f6b7ab9 ("GOPRIVATE must cover hanzos3 + all our orgs"): that was a
correct interim fix when github.com/hanzoai/vfs and github.com/hanzos3/go-sdk
were still private and unreachable through the public proxy. Both are now public
and sumdb-verifiable, so GOPRIVATE is no longer needed. Verified by a clean
(empty-GOMODCACHE) `go mod download all` with GOPRIVATE empty: every module —
including hanzos3/[email protected] and hanzoai/[email protected] (pulled transitively via
luxfi/database/zapdb) — fetches and verifies from proxy.golang.org +
sum.golang.org. dex pulls no zooai/parsdao/lux-private modules.

- Dockerfile, deploy/testnet/Dockerfile: drop `ENV GOPRIVATE=...`. The gh_token
  BuildKit secret stays only for the cold `direct` fetch fallback.
- go.sum: realign luxfi/[email protected] and luxfi/[email protected] h1: hashes to the
  canonical public sumdb values (`go mod tidy`; `go mod verify` = all modules
  verified). go.mod unchanged.

Dockerfile

@@ -18,13 +18,10 @@ FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-bookworm AS builder
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git ca-certificates && rm -rf /var/lib/apt/lists/*
 
-# Private module resolution: all our orgs resolve via the gh_token BuildKit
-# secret over HTTPS (the shared hanzoai/.github docker-build.yml passes it) and
-# bypass the public proxy/sumdb. GOPRIVATE MUST list every private org in the
-# dep graph — dex pulls luxfi + hanzoai + hanzos3 (go-sdk); a missing org routes
-# to proxy.golang.org and fails the build. (Tags may be rewritten — go.sum in the
-# build context is already realigned to current tag bits.)
-ENV GOPRIVATE=github.com/luxfi/*,github.com/hanzoai/*,github.com/hanzos3/*,github.com/zooai/*,github.com/parsdao/*,github.com/lux-private/*
+# No GOPRIVATE — public modules resolve via the immutable public proxy + sumdb.
+# dex's deps (luxfi/*, hanzoai/*, hanzos3/go-sdk) are all PUBLIC now; the immutable
+# proxy+sumdb hash a force-moved tag can't break. The gh_token BuildKit secret
+# below stays only for a cold `direct` fetch fallback.
 ENV GOFLAGS=-mod=mod
 ENV GOTOOLCHAIN=auto
 ENV GOEXPERIMENT=jsonv2

deploy/testnet/Dockerfile

@@ -25,11 +25,10 @@ FROM golang:${GO_VERSION}-bookworm AS builder
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git ca-certificates && rm -rf /var/lib/apt/lists/*
 
-# luxfi/* (and hanzoai/*) modules are private; resolve them over HTTPS with a
-# BuildKit secret (pass with: docker build --secret id=gh_token,env=GH_TOKEN ...).
-# Public testnet code builds fine WITHOUT a token if the module cache/proxy already
-# has the luxfi deps; the secret is only needed for a cold private fetch.
-ENV GOPRIVATE=github.com/luxfi/*,github.com/hanzoai/*
+# No GOPRIVATE — public modules resolve via the immutable public proxy + sumdb.
+# dex's deps (luxfi/*, hanzoai/*, hanzos3/go-sdk) are all PUBLIC now; the immutable
+# proxy+sumdb hash a force-moved tag can't break. The gh_token BuildKit secret
+# below stays only for a cold `direct` fetch fallback.
 ENV GOFLAGS=-mod=mod
 ENV GOTOOLCHAIN=auto
 ENV GOEXPERIMENT=jsonv2

go.sum

@@ -242,7 +242,7 @@ github.com/luxfi/accel v1.2.4 h1:5VbIHyEvvfobn2zBiTFODxDw1CeqxCepZOLlvkuf9yQ=
 github.com/luxfi/accel v1.2.4/go.mod h1:ISIwAX+ZfsL/S5nsP2JvfldXN6Nc+QzoWf6Jtaq+xsQ=
 github.com/luxfi/address v1.0.1 h1:Sc4keyuVzBIvHr7uVeYZf2/WY9YDGUgDi/iiWenj49g=
 github.com/luxfi/address v1.0.1/go.mod h1:5j3Eh66v9zvv1GbNdZwt+23krV8JlSDaRzmWZU8ZRM0=
-github.com/luxfi/age v1.5.0 h1:zC/Fw/ptZwAXr9nqrxmrcf8752EIl1Lq9RECp9OmCO0=
+github.com/luxfi/age v1.5.0 h1:G69HbSV4R3vKEH9B0CulnRaMdSdf4RalMgP8xKmxHeI=
 github.com/luxfi/age v1.5.0/go.mod h1:iAYAxgvrXxcy746+Ovh/eWWDuF9teJLNcCSSOX9RYW0=
 github.com/luxfi/api v1.0.15 h1:Q5ox3Ompw/AZNMfB9wpHZosrj9C+ZldAEHKtHEotFdY=
 github.com/luxfi/api v1.0.15/go.mod h1:Eer59msIXMnOlFncG0XjEGH3TZML0Dd1bUu4GtB7f4Q=
@@ -324,7 +324,7 @@ github.com/luxfi/vm v1.2.5 h1:L1etY/gh68f9tns1BtyDUpZcBVqc3Ng1mqU3n38GyLo=
 github.com/luxfi/vm v1.2.5/go.mod h1:TCCg4lDcQFCjxaxfXnxPIrpRSVAyyf2ucT4A4w654Hg=
 github.com/luxfi/warp v1.19.5 h1:vigIDV4JxLz8bLxQ97dOIcZVM9FAXHmrKdmIh+/WWvk=
 github.com/luxfi/warp v1.19.5/go.mod h1:t5upY5vhKvjapImmUsgPUlW8C8LZhvQpQg5WzAitQs0=
-github.com/luxfi/zap v0.8.11 h1:jT+ol9rj557MRdmnzxrVUCR3CDFaE+8OpzUsLIn92og=
+github.com/luxfi/zap v0.8.11 h1:NIiZp/YyS1TQHfU/PHnMXynzPOKCfZOQssn5ytCdYXg=
 github.com/luxfi/zap v0.8.11/go.mod h1:JfqII8VtVQYLLTX6obU1DP9sjGqf9L24vfug5ifh0b8=
 github.com/luxfi/zapcodec v1.0.1 h1:pRxLxCOi6uihQMg8A8riDjNjefU2cXZxfRVZ+obeuL8=
 github.com/luxfi/zapcodec v1.0.1/go.mod h1:txrRt2JK4O76ssTxlXIwoNVsgzyZVL0ES4mlXqGNogs=