Exclude build proxy artifacts from native provider module archives

Authored-By: Codex (GPT-6) <noreply@openai.com>

tools/private-modules/main.go

@@ -21,6 +21,7 @@ import (
 
 const bundleRoot = "third_party/go-proxy"
 const privatePrefix = "code.fritzlab.net/"
+const archiveBoundary = "module code.fritzlab.net/action/image-build/private-module-artifacts\n\ngo 1.27.0\n"
 
 type artifact struct {
 	Path   string `json:"path"`
@@ -79,6 +80,9 @@ func generate() error {
 		return err
 	}
 	defer os.RemoveAll(temp)
+	if err := os.WriteFile(filepath.Join(temp, "go.mod"), []byte(archiveBoundary), 0444); err != nil {
+		return err
+	}
 	decoder := json.NewDecoder(bytes.NewReader(raw))
 	var total int64
 	for {
@@ -226,7 +230,11 @@ func check() error {
 	if mod != m.GoModSHA256 || sum != m.GoSumSHA256 {
 		return errors.New("private module closure stale; regenerate after go.mod/go.sum changes")
 	}
-	expected := map[string]bool{"manifest.json": true}
+	boundary, err := os.ReadFile(filepath.Join(bundleRoot, "go.mod"))
+	if err != nil || string(boundary) != archiveBoundary {
+		return errors.New("private module archive boundary missing or modified")
+	}
+	expected := map[string]bool{"manifest.json": true, "go.mod": true}
 	last := ""
 	var total int64
 	for _, m := range m.Modules {