ci/deploy: retry go mod download on Go proxy stream errors #1723

Problem

Go module downloads from the public Go proxy intermittently fail with an HTTP/2 stream reset, for example:

go: <module>@<version>: read "https://proxy.golang.org/<module>/@v/<version>.zip": stream error: stream ID 1; INTERNAL_ERROR; received from peer

There is no retry, so one dropped stream fails the whole job. It happened three times on platform on 2026-11-04, each time on unrelated changes:

A re-run of the failed jobs passed each time. The deploy failure leaves main's latest deploy red until the next push.

Proposal

Add a small bounded retry around go mod download wherever modules are fetched:

• Dockerfile:47 and Dockerfile.dev:30. For example RUN for i in 1 2 3; do go mod download && break; [ $i = 3 ] && exit 1; sleep $((i * 5)); done, or a tiny shared script.
• .github/workflows/ci.yml:306-307 (the per-module go mod download && go mod verify loop). Retry the download only; keep go mod verify single-shot, so a checksum mismatch still fails at once.
• Optionally, prefetch modules with the same retry before the golangci-lint step, so its typecheck doesn't fetch on its own.

Keep it bounded (3 attempts with a short backoff). A real resolution or checksum error must still fail the job. Precedent: #74 added a bounded retry for govulncheck's vuln-DB fetch.

Not in scope

Changing proxies, GOPROXY/GOFLAGS settings, or module pins.