fix(actions): route renovate go mod tidy through the module proxy

[kushuh]

What

Switches the self-hosted Renovate action's Go environment from GOPROXY=direct to GOPROXY=https://proxy.golang.org,direct, and adds GOPRIVATE=github.com/a-novel,github.com/a-novel-kit.

Why

With GOPROXY=direct, Renovate's go mod tidy (run via postUpdateOptions: gomodTidy) resolves every dependency straight from its origin. For vanity-import paths this means an HTTPS ?go-get=1 meta lookup + git clone against the upstream host, which is far flakier than the CDN-backed module proxy.

This morning a transitive dep reset the connection mid-fetch:

gonum.org/v1/gonum/stat/distuv: unrecognized import path "gonum.org/v1/gonum":
  https fetch: Get "https://gonum.org/v1/gonum?go-get=1": read: connection reset by peer
Command failed: go mod tidy

When go mod tidy aborts, go.sum is never regenerated. The bumped PR then ships a go.mod referencing the new version with a go.sum still on the old one — which surfaces downstream as the cryptic generated-go failure could not import <module> (invalid package name: "") (mockery / go/packages refusing to load an unverifiable module). It hit a-novel/service-authentication#987 and a-novel/service-json-keys#711 (both jwt v1.1.69 bumps).

Fix

• Public deps go through proxy.golang.org (reliable, cached), with direct as fallback when the proxy can't serve a version.
• Internal modules (a-novel*) are covered by GOPRIVATE, so they're fetched directly from GitHub (reliable host) and skip the public sumdb — meaning freshly tagged internal versions work immediately without waiting for proxy.golang.org to index them.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the self-hosted Renovate composite action to make Go module resolution more reliable during go mod tidy by routing public module downloads through the official Go module proxy while keeping internal modules fetched directly.

Changes:

• Switch Go module fetching from GOPROXY=direct to GOPROXY=https://proxy.golang.org,direct.
• Add GOPRIVATE=github.com/a-novel,github.com/a-novel-kit to treat internal modules as private (skip proxy/sumdb).
• Document the rationale and failure mode being addressed (flaky vanity-import lookups causing incomplete go.sum updates).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.