The Go build module says at a build's end which mesh packages its programs import, so a fingerprint can take their content (ADR 0593 §2)

A build ask whose job built an artifact asks the new step build_go_imports once: `go list -deps` of each Go bundle's program,
no tests, the forge's packages outside the module's own directory (a sibling package of the same repository counts), sorted
and each once. The answer carries them as BuildAnswer.Imports. The step is also a tool, to read them by hand.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

modules/mesh-build-go/module.json

@@ -48,6 +48,7 @@
     "build_go_test",
     "build_go_digest",
     "build_go_build",
+    "build_go_imports",
     "build_go_release",
     "build_go_step",
     "build_go_steps",