* fix: move work dir outside of GOPATH * fix: go flags so they default to -mod=vendor * move tool installs into a tools directory * fix: remove hack/tools from script verify * fix: add ./hack/tools/* to validate cp headers