fix: keep go env cache from invalidating npm layer

scripts/artifact-publish.mjs

@@ -951,9 +951,9 @@ function envReuseDockerfile(baseImage, labels = [], recipe, service = null) {
     ...labels.map(([name, value]) => `LABEL ${name}=${dockerfileQuote(value)}`),
     "COPY package.json ./package.json",
     "COPY package-lock.json* ./",
-    ...(goCacheEnabled ? ["COPY go.mod ./go.mod", "COPY go.sum* ./"] : []),
     `RUN ${downloadEnvPrefix}${osPackageScript}`,
     `RUN ${downloadEnvPrefix}${downloadDependencyScript}`,
+    ...(goCacheEnabled ? ["COPY go.mod ./go.mod", "COPY go.sum* ./"] : []),
     ...(goDownloadScript ? [goDownloadScript] : []),
     `COPY ${normalizedRecipe.launcherPath} /usr/local/bin/hwlab-env-reuse-launcher.ts`,
     `RUN ${readinessScript}`,

scripts/ci-plan.test.mjs

@@ -362,6 +362,7 @@ test("artifact reuse paths preserve catalog provenance instead of current planne
   const artifactPublish = await readFile("scripts/artifact-publish.mjs", "utf8");
   assert.match(artifactPublish, /downloadDependencyScript/u);
   assert.match(artifactPublish, /RUN \$\{downloadEnvPrefix\}\$\{downloadDependencyScript\}/u);
+  assert.match(artifactPublish, /RUN \$\{downloadEnvPrefix\}\$\{downloadDependencyScript\}`,[\s\S]{0,120}\["COPY go\.mod \.\/go\.mod", "COPY go\.sum\* \.\/"\]/u);
   assert.match(artifactPublish, /ln -sf "\$\{runtimeRoot\}\/\$bun_bin" \/usr\/local\/bin\/bun/u);
   assert.doesNotMatch(artifactPublish, /RUN \$\{dependencyScript\}/u);
   assert.match(artifactPublish, /const catalogProvenance = serviceImageCatalogProvenance\(catalogService\);/u);