cmd/dist: problems with module zips may not be caught until release time

[heschi]

In #60847 we saw that the module zips were broken, and we didn't find out until after the release had been half-published. Ideally we would have in-band tests of some kind that catch this.

I understand that generating them is expensive, and it may not be so easy to test without adding a lot of latency to the builders. But catching problems at release time is pretty costly too. So I think it makes sense to spend a little time thinking about it.

cc @rsc @bcmills @matloob