build: stop tmp/go.mod sentinel churn from clean targets

tmp/go.mod is a committed sentinel module that keeps `go list ./...` out
of the QEMU/Docker Go module caches under tmp/ (else `make ze-verify`
fails with 'directory outside main module'). Two clean targets deleted
it, and because it is tracked, git reported a phantom ` D tmp/go.mod`
that sessions kept re-committing (commit 89d383c added a band-aid
comment).

- `clean` (rm -rf bin/ tmp/) now recreates tmp/go.mod byte-identically
  from HEAD after the rm.
- `ze-clean-tmp` (deletes tmp/ files older than 24h) now spares go.mod
  via -not -name go.mod, matching how it already spares the cache dirs.

The sentinel's comment is corrected: it is tracked (not 'local-only')
and recreated by both clean and qemu-run.py. TMP_SENTINEL in qemu-run.py
is kept byte-identical to tmp/go.mod (verified, 914 bytes each), so
recreation never produces a diff.

Verified: ze-clean-tmp scratch-dir test keeps go.mod while deleting
stale files; make -n clean shows the recreation; byte-identity MATCH.

Author: thomas-mangin

Makefile

@@ -426,14 +426,18 @@ ze-regen-check: ze-regen
 ze-doc-links:
 	@python3 scripts/dev/check_doc_links.py
 
+# clean wipes bin/ and tmp/, then restores the tmp/ sentinel module
+# (tmp/go.mod) byte-identically from git so clearing scratch never shows up
+# as a phantom "deleted tmp/go.mod" in git status. See tmp/go.mod.
 clean:
 	@echo "Cleaning..."
 	rm -rf bin/ tmp/
 	rm -f coverage.out coverage.html
+	@mkdir -p tmp && git show HEAD:tmp/go.mod > tmp/go.mod 2>/dev/null || true
 
 ze-clean-tmp:
 	@echo "Cleaning tmp/ scratch files older than 24h..."
-	@find tmp/ -maxdepth 1 -type f -mmin +1440 -delete 2>/dev/null || true
+	@find tmp/ -maxdepth 1 -type f -not -name go.mod -mmin +1440 -delete 2>/dev/null || true
 	@find tmp/ -maxdepth 1 -type d -not -name tmp -not -name session \
 		-not -name go-cache -not -name golangci-lint-cache -not -name kernel \
 		-mmin +1440 -exec rm -rf {} + 2>/dev/null || true

scripts/evidence/qemu-run.py

@@ -54,8 +54,14 @@ def repo_root() -> Path:
 // (e.g. tmp/qemu/gomodcache, tmp/linux-gomodcache). Without this sentinel,
 // `go list ./...` descends into those caches and fails with
 // "directory ... outside main module or its selected dependencies", which
-// breaks `make ze-verify`. tmp/ is .gitignored, so this file is local-only;
-// scripts/evidence/qemu-run.py recreates it on each run.
+// breaks `make ze-verify`.
+//
+// This file is committed (tracked) so it is always present, including on a
+// fresh checkout before any QEMU/Docker run; everything else under tmp/ is
+// .gitignored. `make clean` wipes tmp/ and then recreates this file
+// byte-identically, and qemu-run.py's ensure_tmp_sentinel() recreates it
+// too, so clearing tmp/ never shows up as a git change. Keep this content
+// in sync with TMP_SENTINEL in scripts/evidence/qemu-run.py.
 module ze-tmp-scratch
 
 go 1.25

tmp/go.mod

@@ -5,8 +5,14 @@
 // (e.g. tmp/qemu/gomodcache, tmp/linux-gomodcache). Without this sentinel,
 // `go list ./...` descends into those caches and fails with
 // "directory ... outside main module or its selected dependencies", which
-// breaks `make ze-verify`. tmp/ is .gitignored, so this file is local-only;
-// scripts/evidence/qemu-run.py recreates it on each run.
+// breaks `make ze-verify`.
+//
+// This file is committed (tracked) so it is always present, including on a
+// fresh checkout before any QEMU/Docker run; everything else under tmp/ is
+// .gitignored. `make clean` wipes tmp/ and then recreates this file
+// byte-identically, and qemu-run.py's ensure_tmp_sentinel() recreates it
+// too, so clearing tmp/ never shows up as a git change. Keep this content
+// in sync with TMP_SENTINEL in scripts/evidence/qemu-run.py.
 module ze-tmp-scratch
 
 go 1.25