agents-dev/agent-hub: this dev env has GOFLAGS=-mod=mod, so ANY go build/vet/test run appends module-graph hashes to go.sum as an unstaged change. Not a real dep change — restore with git checkout -- go.sum and run agents/validators with explicit GOFLAGS=-mod=readonly (tree is verified green under readonly). Never commit a dirty go.sum without a bead approving a dep change.