chore(ci): enforce module tidiness in Build CI

[cubahno]

Makes an untidy go.mod/go.sum fail as what it is, instead of surfacing later as a confusing codegen error.

Why

Nothing checked module tidiness. So when examples/go.sum went stale, it showed up much later inside make generate as:

go: updates to go.mod needed; to update it:
	go mod tidy
make[1]: *** [Makefile:8: generate] Error 1

which reads as a code generator bug. #106 and #113 sat red for two weeks looking like exactly that, when the real problem was one go mod tidy in examples/.

Two bugs in the existing target

A tidy-ci target already existed for this, and it had two problems:

1. It was wired into nothing. build-ci was check-fmt lint-ci gosec and test-ci was test. Neither called it.

2. It invoked a tool this repo never installs. Both Makefiles called tidied -verbose, but tidied appears in no go install, no make tools target, and no workflow:

   $ grep -rn tidied Makefile examples/Makefile .github/workflows/
   Makefile:61:            tidied -verbose
   examples/Makefile:17:   tidied -verbose
   $ command -v tidied
   (not found)
   

   So had anything ever called it, it would have failed with tidied: command not found.

What this does

• Replaces tidied -verbose with go mod tidy -diff in both Makefiles. That is built into the Go toolchain already in use (added in Go 1.23; repo is on 1.25.7), so it adds no dependency, nothing to install, and nothing further for Renovate to track.
• Adds tidy-ci to build-ci, so it runs in the Build CI job.

tidy-ci already recursed into child modules via git ls-files '**/*go.mod', so this covers root and examples/ both.

Verification

Both modules are currently tidy, so the check passes:

$ make tidy-ci
go mod tidy -diff          # root
+ cd examples
go mod tidy -diff          # examples
exit=0

$ make build-ci
0 issues.   # lint, root
0 issues.   # lint, examples
[gosec] ... Issues: 0
exit=0

And it genuinely catches untidiness rather than passing vacuously. Perturbing examples/go.mod with a stale require:

$ go mod edit -require=github.com/google/uuid@v1.5.0 && go mod tidy -diff
diff current/go.mod tidy/go.mod
--- current/go.mod
+++ tidy/go.mod
exit=1

Follow-up this does not cover

This makes the failure legible; it does not auto-fix bot PRs. Renovate is handled by #136 (gomodTidy plus grouping root and examples/ into one branch). Dependabot has no tidy step and cannot be configured from renovate.json — auto-fixing its PRs would mean pushing to the PR branch, which needs pull_request_target or an app token, and which makes Renovate mark its own branches "PR Edited (Blocked)" and stop managing them. Left alone deliberately.

🤖 Generated with Claude Code