With the previous order, `go mod vendor` populated vendor/ from the
current go.mod, and only then did `go mod tidy` prune it. If tidy
changed go.mod, vendor/ was left matching the pre-tidy state, so a
single run could leave vendor/modules.txt inconsistent with go.mod
(it took a second run to converge). Tidying first settles
go.mod/go.sum, then vendor rebuilds vendor/ to match in one pass.
This applies both to the `vendor` recipe (justfile and Makefile)
and to scripts/bump_lazycore.sh.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>