build: mark lux-private private, not all of luxfi

GOPRIVATE switches off the module proxy AND checksum verification together.
Covering github.com/luxfi/* meant every luxfi module was fetched straight from
git and trusted without verification — which is how moved tags got captured into
module caches and served from them indefinitely, making the same commit build on
one machine and fail on another.

Nearly all of luxfi is public and on proxy.golang.org, so it belongs under
normal verification. The private org is lux-private.

Twelve luxfi repos are still private AND still 404 on the proxy, so they are
listed individually rather than by wildcard — coverage now matches what actually
needs a direct fetch, and every other luxfi module is verified against
sum.golang.org again:

  bridge broker compliance erc20-go fasthttp graph hsm indexer
  mpc ordering password pool

The right end state is those repos moving to lux-private; until then the
explicit list keeps the exemption honest instead of blanket.

Co-authored-by: Hanzo Dev <[email protected]>

Dockerfile

@@ -13,8 +13,8 @@ WORKDIR /build
 # Copy luxd directory if present (for manual CI case, which uses local dependency)
 COPY go.mod go.sum luxd* ./
 ENV GONOSUMCHECK=github.com/luxfi/*
-ENV GONOSUMDB=github.com/luxfi/*
-ENV GONOPROXY=github.com/luxfi/*
+ENV GONOSUMDB=github.com/lux-private/*
+ENV GONOPROXY=github.com/lux-private/*
 ENV GOFLAGS=-mod=mod
 # Download lux dependencies using go mod
 RUN --mount=type=cache,target=/root/.cache/go-build \

accounts/abi/bind/bind_test.go

@@ -2189,7 +2189,7 @@ func golangBindings(t *testing.T, overload bool) {
 			filteredEnv = append(filteredEnv, entry)
 		}
 	}
-	goEnv = append(filteredEnv, "GOWORK=off", "GOPRIVATE=github.com/luxfi/*")
+	goEnv = append(filteredEnv, "GOWORK=off", "GOPRIVATE=github.com/lux-private/*")
 	moder.Env = goEnv
 	if out, err := moder.CombinedOutput(); err != nil {
 		t.Fatalf("failed to convert binding test to modules: %v\n%s", err, out)