fix(docker): build with all 6 siblings via generated go.work

The Dockerfile only cloned eyrie and ran 'go mod download' before any
workspace existed — so it hit the frozen-proxy checksum SECURITY ERROR and
missed the other 5 siblings hawk now imports. Clone all 6 into external/ and
generate a go.work with replace directives (the committed go.work is excluded
by .dockerignore), then build without a pre-download. Verified the build
sequence locally produces the hawk binary.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Patel230

Dockerfile

@@ -5,15 +5,27 @@ RUN apk add --no-cache git ca-certificates tzdata
 
 WORKDIR /build
 
-# Clone eyrie (unpublished dependency with local-only packages).
-RUN git clone --depth=1 https://github.com/GrayCodeAI/eyrie.git /eyrie
-
-COPY go.mod go.sum ./
-RUN go mod download
+# GrayCodeAI sibling modules are unpublished at their current code (the public proxy
+# froze v0.1.0 at old commits). Resolve them locally via the committed go.work
+# (use . + replace => ./external/<repo>), bypassing the proxy/sumdb entirely.
+ENV GOPRIVATE=github.com/GrayCodeAI/* \
+    GONOSUMDB=github.com/GrayCodeAI/* \
+    GONOSUMCHECK=1
 
 COPY . .
-# Use go.work to resolve the local eyrie checkout — avoids mutating go.mod at build time.
-RUN go work init . /eyrie && \
+
+# Clone every sibling hawk imports into ./external, then generate a go.work that
+# resolves them locally. NOTE: the committed go.work/go.work.sum are excluded by
+# .dockerignore, so we must (re)create the workspace here. Do NOT run
+# 'go mod download' first — the frozen-proxy v0.1.0 fails checksum verification.
+RUN rm -rf external go.work go.work.sum && mkdir -p external && \
+    for repo in eyrie inspect sight tok trace yaad; do \
+      git clone --depth=1 "https://github.com/GrayCodeAI/${repo}.git" "external/${repo}"; \
+    done && \
+    { echo "go 1.26.4"; echo; echo "use ."; echo; echo "replace ("; \
+      for repo in eyrie inspect sight tok trace yaad; do \
+        echo "	github.com/GrayCodeAI/${repo} => ./external/${repo}"; \
+      done; echo ")"; } > go.work && \
     CGO_ENABLED=0 GOOS=linux go build -trimpath \
     -ldflags="-s -w -X main.Version=$(git describe --tags --always 2>/dev/null || echo dev)" \
     -o hawk ./cmd/hawk