Remove the tracked vendor directory and build cloudflared from the locked Go module graph instead. - Use read-only module mode for build, test, vet, formatting, and linting. - Configure CI and Docker builders to use Athens with public-proxy and VCS fallback. - Download modules in a separate Docker layer for reusable image builds. - Remove obsolete module checksums and add the missing shell interpreter to the FIPS verification script. Closes TUN-10829