drop the no-replaces gate

Remove check-no-replaces.sh, the release-prep-guard job in v2-checks, and the pre-flight call in v2-release. go.work keeps go.mods clean during development and replaces are dropped at release-prep, so the separate gate is not needed. The runbook keeps a manual reminder to confirm no replace directives remain before tagging.

Author: james00012

.github/workflows/v2-checks.yml

@@ -56,15 +56,3 @@ jobs:
 
       - name: Release-mode build (all 16 modules pin + external consumer, GOWORK=off)
         run: bash scripts/check-release-mode.sh
-
-  release-prep-guard:
-    name: No local terratest replaces (release commits only)
-    runs-on: ubuntu-latest
-    if: |
-      startsWith(github.ref, 'refs/tags/modules/') ||
-      contains(github.event.head_commit.message, '[release-prep]')
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
-      - run: bash scripts/check-no-replaces.sh

.github/workflows/v2-release.yml

@@ -6,7 +6,6 @@ name: v2 Release (lockstep tag push)
 # Use this AFTER:
 #   - scripts/release-prep.sh ran on the release-prep branch
 #   - The release-prep commit was reviewed and approved
-#   - check-no-replaces.sh passes on that commit
 
 on:
   workflow_dispatch:
@@ -40,7 +39,6 @@ jobs:
         with:
           ref: ${{ inputs.commit_sha }}
           persist-credentials: false
-      - run: bash scripts/check-no-replaces.sh
       - run: bash scripts/check-acyclic-deps.sh
       - run: bash scripts/check-single-source.sh
       - run: bash scripts/check-siv-placement.sh

docs/v2-release-runbook.md

@@ -51,9 +51,9 @@ build is validated continuously without committing the pin or needing tags.
 3. Set every internal `require` to the exact version being tagged, then DROP all
    internal `replace` directives. Do not run `go work sync` against the unpinned
    tree.
-4. CI guard: run `bash scripts/check-no-replaces.sh`; it must pass before tagging.
-   It catches both single-line and block-form `replace ( ... )` directives, which
-   a plain `grep '^replace'` would miss.
+4. Before tagging, confirm no internal `replace` directives remain in any
+   `modules/*/go.mod`. A committed `replace` would publish a module pointing at a
+   local path and break consumers.
 5. Move `test/` to its own module here too if not already done, and pin it the
    same way (it is test-only, so committed `replace`s are acceptable for it).