Find missing go.sum entries on PRs for modules not in the compile matrix

[evaline-ju]

Problem

authbridge/cmd/authbridge-cpex shipped a broken go.sum to main in #849 and surfaced only in build.yaml, which runs on v* tags, main pushes, and workflow_dispatch — never on the PR that introduced it. #862 patched the go.sum but the class of bug remains.

#855 adds abctl and authbridge-praxis to ci.yaml's coy excludes cpex (CGO + libcpex_ffi.a from a pinned
release). Any cmd/* module with replace ... => ../../y will drift the same way until a release
surfaces it.

Proposal

Add go mod tidy -diff to ci.yaml. It exits non-zero when go.mod/go.sum would change catches drift for cpex, authbridge/scripts/lite-tags, and any future module. To consider: .github/workflows/dependabot-tidy.yml already has the same find loop but is gated to dependabot only.

      - name: Verify module graph is tidy
        env:
          GOWORK: "off"
        run: |
          set -euo pipefail
          while IFS= read -r -d '' go_mod; do
            (cd "$(dirname "$go_mod")" && go mod tidy
          done < <(find authbridge -name go.mod -not | sort -z)

Related

#849, #862, #855