ci(vendor-hash): fix fake-hash leak; batch indirect Go deps

[cpcloud]

Fixes accumulated while watching Renovate shake this out end-to-end (PRs #974 and #977).

What went wrong

update-vendor-hash.yml committed a sentinel hash (PR #974). The compute step writes sha256-AAAA... into nix/package.nix, runs nix build, parses got: sha256-.... On the old_hash == new_hash branch it was exiting before the final sed restored the real hash, leaving the sentinel in the file. go mod tidy still touched go.mod/go.sum, so git diff --cached was non-empty and Commit and push ran with the sentinel. Verify build was gated on changed == 'true', so nothing caught it. See run 24829437487: vendorHash unchanged (sha256-wDz1EKWKPkubV8NcBGQnLnRi4XT0rCjOQBKtO/yRdds=), nothing to do followed by [renovate/major-go-indirect ee7cceb] chore: update vendorHash for Go dependency changes.

Renovate kept opening major-version indirect bumps (PRs #974, #977). github.com/openai/openai-go and modernc.org/libc got proposed v1 -> v3 and v1 -> v2 updates. go mod why github.com/openai/openai-go/v3 returns (main module does not need package ...) -- the new major is a different module path and nothing in the repo imports it, so go mod tidy strips the lines every time. The PR never reconciles with main.

The batched go-indirect run (#977) then tripped two pre-commit hooks as false positives. After go mod tidy reshapes go.sum without altering vendor contents, Commit and push hits vendor-hash-check ("go.sum changed but nix/package.nix is unchanged") and go-mod-tidy ("tidy would modify files" -- the upstream Tidy go modules step already tidied).

Changes

• .github/workflows/update-vendor-hash.yml
  • Move the restoration sed ahead of the unchanged-check so the file always holds a real hash before any exit.
  • | head -n1 on the grep to defend against multi-line got: output.
  • SKIP: vendor-hash-check,go-mod-tidy env on Commit and push. Narrow per-hook skip via the prek SKIP variable, scoped to the step that the workflow is itself the authority for. All other hooks still run.
• renovate.json
  • separateMajorMinor: false, separateMultipleMajor: false, separateMinorPatch: false on the go-indirect rule so every indirect update lands in one PR regardless of semver.
  • New rule disabling matchUpdateTypes: ["major"] for indirect deps under gomod -- stops the doomed major-bump PRs at the source.

Reproduction

1. Merge a real dep change that only touches go.sum line checksums (no vendor-content delta).
2. Open any Renovate PR that only bumps an unused indirect dep to a new major version.
3. Observe: before this PR, (1) leads to a sentinel-hash commit and (2) leads to an unfixable PR that go mod tidy keeps reverting. After this PR: (1) restores the real hash cleanly and (2) never gets opened.

Follow-up

Close #974 and #977 -- their branches carry the broken commits and Renovate will open fresh batched non-major PRs under the new rules.