ci: set GOPROXY=direct to bypass stale-proxy go.sum mismatch

The tok v0.1.0 tag was moved; the public module proxy can cache the old
zip for that immutable version, causing checksum mismatches against the
refreshed go.sum. Fetching GrayCodeAI modules directly from VCS keeps CI
consistent with the committed hashes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Patel230

.github/workflows/ci.yml

@@ -36,6 +36,11 @@ env:
   GOPRIVATE: "github.com/GrayCodeAI/*"
   GONOSUMDB: "github.com/GrayCodeAI/*"
   GONOSUMCHECK: "1"
+  # Fetch GrayCodeAI modules straight from VCS rather than the public module
+  # proxy. The proxy can cache a stale zip for a version whose tag has been
+  # moved (e.g. tok v0.1.0), producing go.sum checksum mismatches; direct git
+  # fetch always matches the current tag content recorded in go.sum.
+  GOPROXY: "direct"
 
 jobs:
   # -------------------------------------------------------------------------