ci: verify go.mod and go.sum stay in sync on PRs

Add a go-mod-sync job that runs go mod tidy and fails if go.mod or
go.sum drift from the module graph.

Author: graham-chainlink

.github/workflows/pull-request-main.yml

@@ -7,6 +7,22 @@ on:
       - main
 
 jobs:
+  go-mod-sync:
+    name: Go Mod Tidy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Ensure go.mod and go.sum match module graph
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum
+
   ci-lint:
     name: Lint
     runs-on: ubuntu-latest