Harden release validation

scripts/build-release-assets.sh

@@ -7,6 +7,11 @@ script_dir=$(CDPATH= cd "$(dirname "$0")" && pwd -P)
 
 tool_name=build-release-assets
 
+# Release builds always use the tagged module in this repository. Own this
+# setting here so direct callers and CI cannot supply an ambient Go workspace.
+GOWORK=off
+export GOWORK
+
 if [ "$#" -ne 2 ]; then
 	narratio_release_fail "$tool_name" 'usage: scripts/build-release-assets.sh VERSION OUTPUT_DIR'
 fi