harness: fail an untidy go.mod

go get marks a module indirect until something imports it, and the allowlist
check only inspects direct requires — so an unapproved dependency could sit in
go.mod unnoticed. Demonstrated: adding github.com/google/uuid passed the
allowlist check and was caught only by this gate.

HARNESS.md

@@ -82,7 +82,9 @@ load-bearing mechanism here, and the one with least machine enforcement, which i
 fails any `.go` change that does not touch `state.md`. That does not prove the counters are *right*;
 it makes forgetting them impossible, which is the real failure mode.
 
-**The dependency allowlist** names modules that are permitted, not required. `#` starts a comment anywhere on a line, including after an entry — the gate strips those, so an entry may carry the reason it exists. Being listed is permission;
+**The dependency allowlist** names modules that are permitted, not required. The gate also fails an
+untidy `go.mod`, because `go get` marks a module indirect until something imports it — and an indirect
+entry is not checked against the allowlist, so an unapproved dependency could sit there unnoticed. `#` starts a comment anywhere on a line, including after an entry — the gate strips those, so an entry may carry the reason it exists. Being listed is permission;
 `DEPS_MAX` counts what `go.mod` actually pulls in. `scripts/allowed-deps.txt` is the list.
 
 **Budgets in `scripts/budgets.env`.** Two hard LOC ceilings, core and extensions, plus a dependency

scripts/verify.sh

@@ -236,6 +236,14 @@ if [ -f scripts/allowed-deps.txt ]; then
   fi
 fi
 
+# An untidy go.mod misreports what is direct, so the allowlist check above would silently skip a
+# dependency added by `go get` before anything imported it.
+if go mod tidy -diff >/tmp/tidy.log 2>&1; then
+  pass "go.mod is tidy"
+else
+  bad "go.mod is untidy — run go mod tidy; until then a direct dependency can hide as indirect"
+fi
+
 if [ "$total" -gt "$DEPS_MAX" ]; then
   bad "module count $total exceeds DEPS_MAX=$DEPS_MAX"
 else