ci: verify vendor is reproducible from Artifactory on every main push

Step 3 of #2372, and not the step originally planned. Wiring go-test was
the wrong target once the release path was examined.

Releases build entirely from committed vendor/: .goreleaser.yaml pins
GOFLAGS=-mod=vendor on both aicr and aicrd and sets `gomod: proxy: false`,
and go-build-release pins it too. A release build therefore never contacts
a module proxy, so routing it would intercept nothing. Dependency ingress
for a release happened earlier, when someone ran `make tidy` locally and
committed the result.

What can be established is the property that matters: the vendored bytes a
release ships are reproducible from Artifactory. Regenerating vendor/
through the proxy and diffing against what is committed proves every
dependency in a release artifact could have come from Artifactory, without
the build needing to fetch at all. Verified on run 32860251746:
"vendor/ regenerated through the proxy is byte-identical to what is
committed".

Runs on main only. A push to main is trusted, so id-token: write is
available and no fork ever reaches it. The merge gate stays untouched, so
PR CI keeps its current latency and outside contributors are unaffected —
forks must never hold an Artifactory credential.

Path-filtered to the inputs that decide what gets vendored, plus the
workflow and action themselves so a change to the check cannot skip its
own verification. Measured cost: 104s.

Also retains the resolver-posture assertion, which is a regression check
on the action itself: it exports GOFLAGS=-mod=readonly job-wide, and CI
confirmed that moves resolution off vendor/ unless a caller overrides it
inline. `make test` does (Makefile:275); the assertion fails loudly if a
future kit version breaks that.

Signed-off-by: Mark Chmarny <mark@chmarny.com>

Author: mchmarny

.github/workflows/dgxc-goproxy-probe.yaml

@@ -20,6 +20,28 @@
 name: DGXC Go Proxy Probe
 
 on:
+  # Releases are cut from main and build entirely from committed vendor/
+  # (`.goreleaser.yaml` pins GOFLAGS=-mod=vendor on both binaries and sets
+  # `gomod: proxy: false`), so a release build never contacts a proxy and
+  # there is no fetch there to route. What can be established instead is that
+  # the vendored bytes a release ships are *reproducible from Artifactory* —
+  # which is what the vendor-equivalence step below asserts.
+  #
+  # Runs on main only. A push to main is always trusted, so `id-token: write`
+  # is available and no fork ever reaches this workflow. The merge gate is
+  # deliberately untouched: PR CI stays best-effort and frictionless.
+  push:
+    branches:
+      - main
+    paths:
+      # The inputs that decide what gets vendored...
+      - 'go.mod'
+      - 'go.sum'
+      - 'vendor/**'
+      # ...and everything the check is made of, so a change to the gate
+      # cannot skip its own verification.
+      - '.github/workflows/dgxc-goproxy-probe.yaml'
+      - '.github/actions/setup-dgxc-goproxy/**'
   workflow_dispatch: {}
 
 permissions: