lockvet v0.3.13

lockvet v0.3.13

The Go module proxy joins the registry lineup (npm · PyPI · crates.io ·
RubyGems · Packagist · NuGet · Hex · Go). Two anonymous GETs per changed
module against proxy.golang.org — the same endpoints go get uses.
GOPROXY is honoured (private proxies work; off/direct disables the check).

• Retractions with the author's rationale: a bump onto a retracted
  version lands in the deprecation lane with the rationale comment from
  the module's latest go.mod (retracted: https://github.com/klauspost/compress/issues/1114), including
  retractions deps.dev hasn't re-indexed. -fail-on deprecated gates them.
• // Deprecated: module notices caught where deps.dev misses them
  (live: go.mongodb.org/mongo-driver → "Use go.mongodb.org/mongo-driver/v2
  instead").
• Registry-verified unlisted: the proxy never removes a cached version,
  so absence-while-siblings-exist is real signal — and brand-new tags no
  longer raise false ▲ alarms (they get their ⏱ age instead).
• Fresh-tag ages from @v/{version}.info; pseudo-versions parse their
  embedded commit time locally (no request).
• Renamed-repo guard: a redirected repo serves the new module's go.mod,
  whose directives are never applied to the old path.
• proxy.golang.org sends ACAO:* — the browser playground gets every signal.