Fix private Go and Rust package integrity

[bigboateng]

Summary

• publish Go from the clean tagged Git tree so its checksum matches the public module
• mark Rust dependencies as crates.io dependencies in the private sparse index

Verification

• reproduced Go checksum mismatch through the public gateway
• reproduced Cargo dependency resolution failure through the private index
• workflow diff passes git diff --check

After merge, v0.1.7 will be republished and both website install commands will be exercised end to end.