Add reusable CI preparation operations

internal/gotool/gotool.go

@@ -89,6 +89,30 @@ func New(ctx context.Context, directory string) (*Tool, error) {
 	return tool, nil
 }
 
+// PrepareBuildDependencies downloads module dependencies with the available
+// local Go toolchain. It preserves caller module-network settings and caches,
+// while disabling workspace discovery and automatic toolchain downloads.
+func PrepareBuildDependencies(ctx context.Context, directory string) error {
+	captured := &combinedWriter{}
+	err := process.Run(ctx, process.Invocation{
+		Args: []string{"go", "mod", "download"},
+		Dir:  directory,
+		Env: map[string]string{
+			"GOWORK":      "off",
+			"GOTOOLCHAIN": "local",
+		},
+		Stdout: captured,
+		Stderr: captured,
+	})
+	if err != nil {
+		if output := strings.TrimSpace(string(captured.Bytes())); output != "" {
+			return fmt.Errorf("go mod download: %w: %s", err, output)
+		}
+		return fmt.Errorf("go mod download: %w", err)
+	}
+	return nil
+}
+
 // HostTarget reports the Go command's host operating system and architecture.
 func (tool *Tool) HostTarget() Target {
 	return tool.host