fix(ci): resolve siblings via go.work replace (not use) + require yaad

The 'use ./external/*' workspace form still verified each required sibling
version against the frozen public proxy/sumdb, causing 'checksum mismatch /
SECURITY ERROR' on vet and module-hygiene (local HEAD != frozen v0.1.0 tag).
Switch go.work to 'use .' + explicit 'replace => ./external/<repo>' for all
six siblings — replace fully bypasses proxy verification (matching the
sibling repos). Add the missing 'require yaad v0.1.0' (replace needs a
matching require; yaad is imported in 136 files).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Patel230

go.mod

@@ -1,11 +1,12 @@
 go 1.26.4
 
-use (
-	.
-	./external/eyrie
-	./external/inspect
-	./external/sight
-	./external/tok
-	./external/trace
-	./external/yaad
+use .
+
+replace (
+	github.com/GrayCodeAI/eyrie => ./external/eyrie
+	github.com/GrayCodeAI/inspect => ./external/inspect
+	github.com/GrayCodeAI/sight => ./external/sight
+	github.com/GrayCodeAI/tok => ./external/tok
+	github.com/GrayCodeAI/trace => ./external/trace
+	github.com/GrayCodeAI/yaad => ./external/yaad
 )