fix: ship vendor/ in the release archive so the catalog can import

The Traefik Plugin Catalog analyzer rejected v1.0.43:

  import "github.com/lukaszraczylo/oss-telemetry" error:
  unable to find source related to: "github.com/lukaszraczylo/oss-telemetry"

piceus fetches the source archive at the released tag and interprets it
with Yaegi. It never runs go mod download, so every non-stdlib import in
production code must exist in the archive own vendor/ tree.

.gitattributes carried "vendor/ export-ignore" with an explicit warning
to remove it the moment production code imported a third-party package.
That happened when llmgateway.go took on oss-telemetry for anonymous
usage reporting, and the warning was missed. The tag itself always had
vendor/; git archive stripped it, so the tarball shipped a go.mod
requiring a module whose source was absent.

Verified by reproducing the analyzer: the v1.0.43 archive contains 0
vendor entries, the fixed archive contains 71, and interpreting the
extracted archive under yaegi passes.

.gitattributes

@@ -3,18 +3,30 @@
 # (.goreleaser.yaml), so these entries are the actual filter for the
 # release source tarball — not the archive block's own file globs, which
 # have no negation syntax and cannot exclude anything.
-# WARNING (v0.2 final review wave, 2026-08-20): vendor/ is safe to
+# vendor/ is deliberately NOT export-ignored, and must stay that way.
-# export-ignore ONLY because every current go.mod dependency
+#
-# (github.com/stretchr/testify, its go.yaml.in/yaml/v3 indirect) is a
+# It WAS export-ignored until 2026-08-23, on the reasoning that every
-# TEST-only dependency, imported solely by *_test.go files — which are
+# dependency was test-only (github.com/stretchr/testify and its
-# themselves export-ignored below, so the released tarball never contains
+# go.yaml.in/yaml/v3 indirect), imported solely by *_test.go files that
-# code that imports them and never needs vendor/ to build. go.mod itself
+# are themselves export-ignored below — so the tarball never contained
-# is NOT export-ignored and ships in every release tarball as-is. The
+# code needing vendor/ to build. That comment carried an explicit warning
-# moment any non-test .go file (production code, not *_test.go) imports a
+# to remove the line the moment production code imported a third-party
-# third-party package, this line MUST be removed: otherwise the tarball
+# package.
-# ships a go.mod requiring a module its own vendor/ was stripped out of,
+#
-# and the extracted source cannot build standalone.
+# That happened, and the warning was missed: llmgateway.go took on
-vendor/ export-ignore
+# github.com/lukaszraczylo/oss-telemetry as a RUNTIME dependency. The
+# release tarball then shipped a go.mod requiring a module whose source
+# had been stripped, and the Traefik Plugin Catalog analyzer (piceus)
+# rejected v1.0.43 with:
+#
+#   import "github.com/lukaszraczylo/oss-telemetry" error:
+#   unable to find source related to: "github.com/lukaszraczylo/oss-telemetry"
+#
+# piceus fetches the source ARCHIVE at the released tag and interprets it
+# with Yaegi. It never runs `go mod download`, so every non-stdlib import
+# in production code must be present in the archive's own vendor/ tree.
+# Shipping vendor/ also costs the test-only deps a few hundred KB in the
+# tarball, which is the correct trade against being unimportable.
 integration/ export-ignore
 tools/ export-ignore
 docs/ export-ignore