refactor: consume vantage-shared as an external private module

shared/ is extracted to gitea.hostxtra.co.uk/vantage/vantage-shared and
pinned at v0.1.0 by server, agent, admin, sitesvc and vantagectl. The
replace directives and the ./shared entry in go.work are gone.

Every Go build now needs a credential for the private module: CI writes a
netrc per job from REGISTRY_USER + RELEASE_TOKEN and sets GOPRIVATE, and
the four Go Dockerfiles take it as a BuildKit secret rather than a build
arg, which would survive in the builder layer's history. RELEASE_TOKEN
needs read access to the vantage org.

admin, sitesvc and vantagectl now build from their own directory; only
server still needs the repository root, for default_steps/. The rebuild
triggers in server-deploy.yml lose their shared/ patterns, since a
service now moves when its own go.mod pin does.

sitesvc/Dockerfile

@@ -1,16 +1,23 @@
-# Context is the repository root; sitesvc depends on the shared module.
+# Context is sitesvc/ itself. It used to be the repository root, so that
+# shared/ could be copied in beside it; shared is now the private module
+# gitea.hostxtra.co.uk/vantage/vantage-shared, fetched like any other
+# dependency. The credential for it arrives as a BuildKit secret rather than a
+# build arg, which would be baked into this stage's layer history.
 FROM golang:1.26-alpine AS builder
 
 WORKDIR /src
 
-COPY shared/go.mod shared/go.sum ./shared/
-COPY sitesvc/go.mod sitesvc/go.sum ./sitesvc/
-RUN cd sitesvc && go mod download
+ENV GOPRIVATE=gitea.hostxtra.co.uk/*
+RUN apk add --no-cache git
 
-COPY shared/ ./shared/
-COPY sitesvc/ ./sitesvc/
+COPY go.mod go.sum ./
+RUN --mount=type=secret,id=netrc,target=/root/.netrc \
+    go mod download
 
-RUN cd sitesvc && CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /out/sitesvc ./cmd
+COPY . .
+
+RUN --mount=type=secret,id=netrc,target=/root/.netrc \
+    CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /out/sitesvc ./cmd
 
 FROM alpine:3.20 AS runner