Vendor every dependency, so no build fetches the host's validator (hq to-be 45 D1)

The controller imports mesh-host/validate through a replace onto the forge
that holds it, and every build — the build agent's go build in a fresh
toolchain container, the Dockerfile's go mod download — would have fetched
it through the public proxy and checksum database at build time: a merge
breaking main on the network, the class Phase 1 removes. vendor/ is
committed; go builds from it with nothing fetched, and refuses to build
when it and go.mod disagree, so a pin moved without go mod vendor fails at
once. The Dockerfile copies vendor/ and builds with GOPROXY=off.

go.mod

@@ -23,6 +23,9 @@ require (
 )
 
 // The node-engine's own validator (mesh-host/validate, novox/hq to-be 45 D1): one validator, the host's.
-// The host's module path names no forge a build can fetch from, so it is fetched from the one that
-// holds it; the commit is the host's, and moves when its validator does.
+// The host's module path names no forge a build can fetch from, so the module is read from the one
+// that holds it, at the host's commit — **once, by whoever moves the pin, into vendor/**, which is
+// committed. Every build (the build agent's `go build`, the Dockerfile) compiles from vendor/ and
+// fetches nothing; go refuses to build when vendor/ and this file disagree, so a pin moved without
+// `go mod vendor` fails loudly, at once, everywhere.
 replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261006081854-6953b5bafdb2