harness: fail an untidy go.mod

go get marks a module indirect until something imports it, and the allowlist
check only inspects direct requires — so an unapproved dependency could sit in
go.mod unnoticed. Demonstrated: adding github.com/google/uuid passed the
allowlist check and was caught only by this gate.

scripts/verify.sh

@@ -236,6 +236,14 @@ if [ -f scripts/allowed-deps.txt ]; then
   fi
 fi
 
+# An untidy go.mod misreports what is direct, so the allowlist check above would silently skip a
+# dependency added by `go get` before anything imported it.
+if go mod tidy -diff >/tmp/tidy.log 2>&1; then
+  pass "go.mod is tidy"
+else
+  bad "go.mod is untidy — run go mod tidy; until then a direct dependency can hide as indirect"
+fi
+
 if [ "$total" -gt "$DEPS_MAX" ]; then
   bad "module count $total exceeds DEPS_MAX=$DEPS_MAX"
 else