go/v1.0.0: go mod tidy fails in every consumer (retained 0.x files import a removed package)

[EricAndrechek]

go/v1.0.0: go mod tidy fails in every consumer module.

Measured with a fresh consumer importing github.com/wave-rf/chtypes/go/chtypes at v1.0.0 from the Go proxy:

go: github.com/wave-rf/chtypes/go/chtypes imports
	github.com/wave-rf/chtypes/go/internal/testhook: module github.com/wave-rf/chtypes/go@latest found (v1.0.0),
	but does not contain package github.com/wave-rf/chtypes/go/internal/testhook

• Because tidy fails, the consumer's go.sum stays incomplete, so go build also fails until it is worked around: missing go.sum entry … github.com/klauspost/compress/zstd.
• go build, go vet and go mod verify on the module itself are fine.

Cause:

• Five retained 0.x files in go/chtypes/ (fetch.go, fetch_sign.go, multiversion.go, registry_path.go, resolve.go) are excluded from the build by //go:build chtypes_v0_retired.
• go mod tidy considers every build tag except ignore, so it resolves their imports, including go/internal/testhook, which no longer exists.
• The files are retained on purpose: their removal is held in Held for the maintainer: delete the five retained v0 Go verification files and prune their protected-path entries #431.

Workaround until the fix ships: go mod tidy -e.

Fix (measured locally):

• Change those five constraints to //go:build ignore, which go mod tidy excludes.
• With that change:
  • the module's own go mod tidy passes WITHOUT -e, and leaves go.mod/go.sum unchanged;
  • a consumer's go mod tidy and go mod tidy -diff exit 0;
  • the consumer builds.
• The files stay in the tree and stay protected, so this does not pre-empt Held for the maintainer: delete the five retained v0 Go verification files and prune their protected-path entries #431.
• The release verification's Go consumer module then drops its own -e, so every release dry run and every post-publish check runs a consumer go mod tidy and catches this class.

Ships as go/v1.0.1.

🤖 Generated with Claude Code

[EricAndrechek]

Fixed in go/v1.0.1 (#455, tag go/v1.0.1 on ea805a5), measured after publish:

• The Go proxy serves v1.0.1, origin refs/tags/go/v1.0.1 at ea805a5.
• A fresh consumer importing github.com/wave-rf/chtypes/go/chtypes@v1.0.1 from the proxy: go mod tidy exits 0, go mod tidy -diff exits 0, and go build succeeds.
• The release's own post-publish verify (run 37174127722) installed the proxy copy and ran a consumer go mod tidy with no -e, then fetched 26.9 from production and loaded it, with a matching fingerprint.

Every release dry run and post-publish check now runs a consumer go mod tidy without -e, so this class fails before a tag. Consumers on go mod tidy -e as a workaround can upgrade to v1.0.1 and drop it.