XO1319: a third-party `use go` has no `require go` pin

Without a require go line, the binding follows Go’s module resolution, which picks the module’s latest version, and records it only in the gitignored .xo/gobind: two machines, or one machine on two days, could build different code from the same commit. The fix adds require go <module> <version> with the version the binding resolved; xo mod tidy adds missing pins too. Go’s standard library packages need no line. See core 4.4 and decision 0356.

Example

// xo.mod has no require go line
use go "github.com/google/uuid" as uuid

Fix

# xo.mod
require go github.com/google/uuid v1.6.0

Run xo explain XO1319 for this text in a terminal, or see section 10.6 of the specification.