build: make go mod tidy runnable, and drop two dead requirements (V-454)

The vendored toolchain lives inside the module tree, so `go mod tidy` walked
Go's own compiler-error fixtures and died on files that are malformed on
purpose ("unicode//utf8": double slash). A nested module is not part of its
parent, so deps/go.mod ends the walk in three lines. deps/ is gitignored, so
the sentinel is generated by `make deps-sentinel`, which deps-go and deps now
depend on.

The tidy it makes possible drops github.com/kami/praxis, which no file
imports — Praxis is reached over HTTP, by contract. Its replace directive and
the unused nexus one went with it, so a build no longer expects two sibling
checkouts that nothing reads. vendor/ is committed, so `make tidy` re-vendors
in the same breath: a tidy alone leaves the next build failing on
"inconsistent vendoring".

Not wired into `make test`. A build target that rewrites go.mod is a surprise.

Verified: `make build` produces all 9 binaries and `make test` is green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Makefile

@@ -16,7 +16,7 @@ PIPER_BIN     := $(shell pwd)/deps/piper/piper
 PIPER_MODEL   := $(shell pwd)/models/tts/ru_RU-irina-medium.onnx
 PIPER_ESPEAK  := $(shell pwd)/deps/piper/espeak-ng-data
 
-.PHONY: simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go eval-router eval-recall eval-phrasing eval-models build-gpud
+.PHONY: simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel tidy eval-router eval-recall eval-phrasing eval-models build-gpud
 
 all: build
 
@@ -74,7 +74,7 @@ run-web: build-web
 # base.Tool(), which only stats pkg/tool and exits. So build them in once here.
 GO_TARBALL := go$(GO_VERSION).linux-amd64.tar.gz
 GO_SHA256  := 9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b
-deps-go:
+deps-go: deps-sentinel
 	@mkdir -p deps/go
 	cd deps/go && curl -fLO 'https://go.dev/dl/$(GO_TARBALL)'
 	cd deps/go && echo '$(GO_SHA256)  $(GO_TARBALL)' | sha256sum -c -
@@ -84,6 +84,25 @@ deps-go:
 	done
 	$(GO) version
 
+# deps/go.mod — the sentinel that stops the module walk at deps/ (Vikunja #454).
+# The vendored toolchain lives inside the module tree, so `go mod tidy` walked
+# Go's own compiler-error fixtures and died on files that are malformed on
+# purpose ("unicode//utf8": double slash). A nested module is not part of the
+# parent, so one three-line file ends the walk. deps/ is gitignored, so it is
+# generated here rather than committed, and every target that populates deps/
+# writes it.
+deps-sentinel:
+	@mkdir -p deps
+	@printf 'module github.com/kami/maven/deps\n\ngo 1.21\n' > deps/go.mod
+
+# Run the tidy the sentinel makes possible. Not part of `test`: it rewrites
+# go.mod, and a build target that edits the module file is a surprise.
+# vendor/ is committed, so a tidy that drops a requirement must be followed by
+# a re-vendor or the next build fails on "inconsistent vendoring".
+tidy: deps-sentinel
+	GOTOOLCHAIN=local GOFLAGS=-mod=mod $(GO) mod tidy
+	GOTOOLCHAIN=local GOFLAGS=-mod=mod $(GO) mod vendor
+
 # fmt-check fails if any file needs gofmt. docs/design.md has always said `make
 # test` gates on gofmt and vet; it did not, so nine files quietly drifted.
 # Run `gofmt -w` on whatever this prints.
@@ -178,7 +197,7 @@ run-tts: build-tts
 		./mavttsd -socket /tmp/maven/tts.sock \
 			-piper $(PIPER_BIN) -model $(PIPER_MODEL) -espeak_data $(PIPER_ESPEAK)
 
-deps: deps-whisper deps-piper
+deps: deps-sentinel deps-whisper deps-piper
 
 deps-whisper:
 	cd deps/whisper.cpp && cmake -B build -DCMAKE_BUILD_TYPE=Release \