ci: make tidy-clean check robust to a missing go.sum

P0 has no external deps, so go.sum doesn't exist yet and
`git diff --exit-code go.mod go.sum` errored (exit 128) on the missing
path. Use `git status --porcelain` so the check survives a not-yet-created
go.sum and still catches an untidy go.mod or a newly-created go.sum.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -66,7 +66,14 @@ jobs:
       - name: go mod tidy is clean
         run: |
           go mod tidy
-          git diff --exit-code go.mod go.sum
+          # go.sum may not exist yet (no external deps), so don't name it as a
+          # diff path (git errors on a missing path). git status flags both a
+          # modified go.mod and a freshly-created untracked go.sum.
+          CHANGES=$(git status --porcelain -- go.mod go.sum)
+          if [ -n "$CHANGES" ]; then
+            echo "go.mod/go.sum not tidy:"; echo "$CHANGES"; git diff -- go.mod; exit 1
+          fi
+          echo "OK: go.mod/go.sum tidy."
 
       - name: Core stays majordomo+stdlib only
         run: |