fix(ci): drop workflow-level GOFLAGS=-mod=vendor from release pipeline

The `vendor/` directory + `go.mod` >= go 1.14 already auto-select vendor
mode for build/test/lint, so the explicit `GOFLAGS=-mod=vendor` was
redundant — and worse, it broke every `go install <pkg>@<version>` call
in the pipeline:

    go: golang.org/x/vuln/cmd/govulncheck@latest:
        cannot query module due to -mod=vendor

This killed `govulncheck` immediately and would have killed
`license-check` (go-licenses) the same way. Vendor mode still applies
implicitly to the actual `go build` / `go test` / `go generate` calls,
so dropping the env var is a no-op for those.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ynsta

.github/workflows/release.yml

@@ -16,8 +16,12 @@ on:
 permissions:
   contents: read
 
-env:
-  GOFLAGS: -mod=vendor
+# NOTE: do not set `GOFLAGS: -mod=vendor` at workflow level. With a
+# committed `vendor/` directory and `go.mod` >= go 1.14, the toolchain
+# already auto-selects vendor mode for build/test/lint. Setting the env
+# var explicitly *breaks* `go install <pkg>@<version>` (used to fetch
+# govulncheck and go-licenses), which fails with:
+#   `cannot query module due to -mod=vendor`.
 
 jobs:
   lint: