fix(ci): worker docker-publish — drop local replace + bump api pin via goproxy

[haydercyber]

Root cause

worker#4's docker-publish.yml staged the api repo under worker/.deps/api/ and rewrote the local replace path. That worked at the OS level but the Dockerfile runs go mod download before COPY . . (for build-cache layering), so .deps/api/ didn't yet exist in the layer where the replace had to resolve. Every push to main failed at layer 4 with:

go: github.com/secrets-bridge/api@v0.0.0-... (replaced by ./.deps/api):
reading .deps/api/go.mod: open /src/.deps/api/go.mod: no such file or directory

The fix

Drop the local replace AND bump the api pin to api/main's HEAD before docker build. goproxy then serves a pseudo-version matching the current api source, and the Dockerfile's existing COPY go.mod go.sum ./ + RUN go mod download resolves cleanly via the normal module path with no in-context staging needed.

Workflow changes

Step	Before	After
Checkout api alongside worker	✓	removed
mv api-source worker/.deps/api	✓	removed
sed -i ... go.mod (rewrite replace path)	✓	removed
actions/setup-go@v5		added
go mod edit -dropreplace		added
go get github.com/secrets-bridge/api@main		added
go mod tidy		added
docker build context	./worker	.

Pinned version bump

The pseudo-version pin in go.mod jumped from:

• v0.0.0-20260529005625-257ebd2ff86b (pre-#41) → v0.0.0-20260529211927-bd05303fcab4 (current api/main HEAD)

This was necessary anyway: api#41 changed keymgmt.FromEnv(ctx) → (ctx, env), and the old pin couldn't compile worker#4's fix that already passes cfg.Env through.

Verified locally

$ go mod edit -dropreplace github.com/secrets-bridge/api
$ go get github.com/secrets-bridge/api@main
go: downloading github.com/secrets-bridge/api v0.0.0-20260529211927-bd05303fcab4
go: upgraded github.com/secrets-bridge/api v0.0.0-20260529005625-257ebd2ff86b => v0.0.0-20260529211927-bd05303fcab4
$ go mod tidy
$ go build ./...
# clean

Follow-up (post-v0.1.0)

When the api module gets a real semver tag, swap @main for @vX.Y.Z in the workflow AND pin in go.mod permanently. The dynamic @main lookup is acceptable for the rolling :dev channel; semver-tagged builds should be reproducible.