Support nested Go module releases

[bcomnes]

Summary

• add -workdir to version commands and resolve module-relative paths safely
• derive canonical nested-module tags such as go/v1.2.3
• publish nested modules with the same tag across Git, GitHub Releases, and the Go proxy
• preserve legacy library API behavior and module-specific tag discovery
• document and test nested versioning, publishing, major migration, and path escape rejection

Validation

• go test ./...
• git diff --check