protocol: migrate module identity to private Gitea

.gitea/workflows/verify.yml

@@ -13,6 +13,31 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  module:
+    # This Linux job proves that private Gitea consumers can resolve the
+    # module identity and build the tagged Go package without a filesystem
+    # replacement. The full cross-language verifier remains macOS-bound.
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: "1.26.5"
+          cache: true
+          cache-dependency-path: go.mod
+      - name: Verify private module identity and Go packages
+        shell: bash
+        run: |
+          test "$(go list -m -f '{{.Path}}')" = 'git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol'
+          if grep -Eq '^[[:space:]]*replace[[:space:]]' go.mod; then
+            echo 'Protocol module must not use a replace directive' >&2
+            exit 1
+          fi
+          go mod verify
+          go build ./...
+          go test ./... -count=1
+
   verify:
     # The Phase 3A full verifier includes Swift type-checking. The owner must
     # provide a macOS runner with the pinned toolchain from the handoff.