docs: record module hygiene retry behavior

.gitea/workflows/prepare-release.yml

@@ -45,8 +45,15 @@ jobs:
       - name: Module hygiene
         run: |
           set -euo pipefail
+
           go mod tidy
+
+          if ! go mod verify; then
+            echo "go mod verify failed; refreshing module cache and retrying" >&2
+            go clean -modcache
+            go mod download
             go mod verify
+          fi
 
       - name: Restore cached gosec binary
         id: cache-gosec

.gitea/workflows/push-validation.yml

@@ -41,8 +41,15 @@ jobs:
       - name: Module hygiene
         run: |
           set -euo pipefail
+
           go mod tidy
+
+          if ! go mod verify; then
+            echo "go mod verify failed; refreshing module cache and retrying" >&2
+            go clean -modcache
+            go mod download
             go mod verify
+          fi
 
       - name: Restore cached gosec binary
         id: cache-gosec

CHANGELOG.md

@@ -42,6 +42,7 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
 - Replaced `securego/gosec` composite action with a direct `go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4 && gosec ./...` run step so gosec uses the Go 1.26 toolchain installed by `setup-go` rather than the action's bundled Go 1.24 binary which ignores `GOTOOLCHAIN=auto`.
 - Fixed nested local composite-action references to use repository-local `./run-vociferate` paths so strict runners do not misparse parent-directory (`../`) action references as malformed remote coordinates.
 - Consolidated `run-vociferate` binary and source execution flows directly into the main `run-vociferate` action to avoid nested local-action path resolution issues on strict runners.
+- Hardened workflow module hygiene by retrying `go mod verify` after a module-cache refresh (`go clean -modcache` + `go mod download`) when runners report modified cached dependency directories.
 
 ## [1.0.2] - 2026-03-21