go-modules.json, go-packages.json, go-build-info.txt, and toolchain.txt are
bounded, normalized dependency/build inventories. They deliberately omit
builder usernames, absolute source paths, and module-cache locations;
toolchain.txt records only the reviewed deterministic environment controls.
Complete discovered upstream license texts for every Go module shipped in the
Hub or Edge binary are in licenses/; the build fails closed if a required
module license cannot be located.
