Vendor every dependency, so no build fetches the host's validator (hq to-be 45 D1)

The controller imports mesh-host/validate through a replace onto the forge
that holds it, and every build — the build agent's go build in a fresh
toolchain container, the Dockerfile's go mod download — would have fetched
it through the public proxy and checksum database at build time: a merge
breaking main on the network, the class Phase 1 removes. vendor/ is
committed; go builds from it with nothing fetched, and refuses to build
when it and go.mod disagree, so a pin moved without go mod vendor fails at
once. The Dockerfile copies vendor/ and builds with GOPROXY=off.

vendor/github.com/klauspost/compress/internal/regmask/regmask.go

@@ -0,0 +1,50 @@
+//go:build !386
+
+// Package regmask provides masks for variable shift counts.
+//
+// Go defines a shift by more than the width of the shifted value as producing
+// zero, so the compiler has to guard every variable shift against that: on
+// amd64 with a CMP and an SBB, on arm64 with a CMP and a CSEL, and so on. When
+// the count is known to be smaller than the width anyway, masking it with the
+// width minus one lets the compiler drop the guard. The mask itself costs
+// nothing on the architectures whose shift instructions already use only the
+// low bits of the count, which the compiler knows about.
+//
+// Each constant is named for the width of the value being shifted and the type
+// of the shift count, and may only be used where the count is always smaller
+// than that width:
+//
+//	x := y >> (n & regmask.Shift64ByUint) // y is 64 bits, n is a uint below 64
+package regmask
+
+const (
+	// ShiftNByUint8 - shifting an N bit value by a uint8
+	Shift8ByUint8  = 7
+	Shift16ByUint8 = 15
+	Shift32ByUint8 = 31
+	Shift64ByUint8 = 63
+
+	// ShiftNByUint16 - shifting an N bit value by a uint16
+	Shift8ByUint16  = Shift8ByUint8
+	Shift16ByUint16 = Shift16ByUint8
+	Shift32ByUint16 = Shift32ByUint8
+	Shift64ByUint16 = Shift64ByUint8
+
+	// ShiftNByUint32 - shifting an N bit value by a uint32
+	Shift8ByUint32  = Shift8ByUint8
+	Shift16ByUint32 = Shift16ByUint8
+	Shift32ByUint32 = Shift32ByUint8
+	Shift64ByUint32 = Shift64ByUint8
+
+	// ShiftNByUint64 - shifting an N bit value by a uint64
+	Shift8ByUint64  = Shift8ByUint8
+	Shift16ByUint64 = Shift16ByUint8
+	Shift32ByUint64 = Shift32ByUint8
+	Shift64ByUint64 = Shift64ByUint8
+
+	// ShiftNByUint - shifting an N bit value by a uint
+	Shift8ByUint  = Shift8ByUint8
+	Shift16ByUint = Shift16ByUint8
+	Shift32ByUint = Shift32ByUint8
+	Shift64ByUint = Shift64ByUint8
+)

vendor/github.com/klauspost/compress/internal/regmask/regmask_386.go

@@ -0,0 +1,39 @@
+//go:build 386
+
+package regmask
+
+// A 64 bit shift on 386 is synthesized from 32 bit instructions, and masking its
+// count makes the compiler emit more code rather than less, so those masks are
+// no-ops here: each is the largest value its count type can hold, which the
+// compiler folds away. Shifts of narrower values behave as elsewhere.
+const (
+	// ShiftNByUint8 - shifting an N bit value by a uint8
+	Shift8ByUint8  = 7
+	Shift16ByUint8 = 15
+	Shift32ByUint8 = 31
+	Shift64ByUint8 = 0xff
+
+	// ShiftNByUint16 - shifting an N bit value by a uint16
+	Shift8ByUint16  = Shift8ByUint8
+	Shift16ByUint16 = Shift16ByUint8
+	Shift32ByUint16 = Shift32ByUint8
+	Shift64ByUint16 = 0xffff
+
+	// ShiftNByUint32 - shifting an N bit value by a uint32
+	Shift8ByUint32  = Shift8ByUint8
+	Shift16ByUint32 = Shift16ByUint8
+	Shift32ByUint32 = Shift32ByUint8
+	Shift64ByUint32 = 0xffffffff
+
+	// ShiftNByUint64 - shifting an N bit value by a uint64
+	Shift8ByUint64  = Shift8ByUint8
+	Shift16ByUint64 = Shift16ByUint8
+	Shift32ByUint64 = Shift32ByUint8
+	Shift64ByUint64 = 0xffffffffffffffff
+
+	// ShiftNByUint - shifting an N bit value by a uint
+	Shift8ByUint  = Shift8ByUint8
+	Shift16ByUint = Shift16ByUint8
+	Shift32ByUint = Shift32ByUint8
+	Shift64ByUint = ^uint(0)
+)