v0.2.0 tag was moved after publication, causing irreproducible Go module checksums

## Summary

The published `v0.2.0` Git tag appears to have been moved after it had already been indexed by the Go module ecosystem. This violates the immutability expected for released Go module versions and makes clean, checksum-verified downloads irreproducible.

Existing module caches may continue to work, while fresh downloads from a proxy or directly from GitHub can resolve different source trees and fail checksum verification.

## Evidence

The Go proxy metadata observed for `v0.2.0` records the original source commit:

```json
{
"Version": "v0.2.0",
"Time": "2026-03-17T07:03:08Z",
"Origin": {
"Hash": "6ce9fd1e705804948491714cdf594157cb5ebf59"
}
}
```

However, the GitHub ref currently resolves to a different commit:

```text
refs/tags/v0.2.0 -> dd4992be184be611eef20a42877aede012917a40
```

That commit was created on `2026-03-20T12:32:51Z`, after the version above had already been observed by the proxy. It also changes module content, including `go.mod`:

- original indexed commit: https://github.com/cloudwego/gopkg/commit/6ce9fd1e705804948491714cdf594157cb5ebf59
- current tag commit: https://github.com/cloudwego/gopkg/commit/dd4992be184be611eef20a42877aede012917a40

Observed checksum records differ across the resulting artifacts:

```text
github.com/cloudwego/gopkg v0.2.0 h1:EU8Ahrj0rCfKZQdah50zKnlrQ1o2AdPYM87UclIqLME=
github.com/cloudwego/gopkg v0.2.0/go.mod h1:WjQPYI8PesfQalIVcLzVJBb1EAopioZ+D+3UGJ+dNBs=
```

A proxy-cached `go.mod` from the original commit produces:

```text
h1:yK8wKouWJR6rbJ12Qb9VLTwbzcrg7c2rMAXHCfZT6h4=
```

Consequently, a clean module cache cannot reliably reproduce the same verified `v0.2.0` content that an older cache may contain.

## Reproduction

Run with fresh, isolated module caches:

```bash
cache=$(mktemp -d)
GOMODCACHE="$cache" \
GOPROXY=https://proxy.golang.org \
GOSUMDB=sum.golang.org \
go mod download -json github.com/cloudwego/gopkg@v0.2.0
rm -rf "$cache"

cache=$(mktemp -d)
GOMODCACHE="$cache" \
GOPROXY=direct \
GOSUMDB=sum.golang.org \
go mod download -json github.com/cloudwego/gopkg@v0.2.0
rm -rf "$cache"
```

The proxy and direct paths resolve source from different immutable/cached histories and cannot both reproduce one checksum-verified module version.

## Requested resolution

Please:

1. Publish a new immutable release, preferably `v0.2.1`, from the intended source commit.
2. Do not move `v0.2.0` again; Go proxies and the checksum database retain immutable observations, so changing the old tag cannot reliably repair downstream clients.
3. Consider documenting `v0.2.0` as affected and adding a release-process guard that rejects moving an already published tag.

A new version is important because downstream projects cannot safely solve this by disabling `GOSUMDB`, weakening `go.sum`, or relying on a warm module cache.

Start by reproducing the checksum mismatch with the isolated GOMODCACHE, GOPROXY, and GOSUMDB commands in the issue, then compare the indexed commit 6ce9fd1 and current tag commit dd4992b. Review the release process for v0.2.0 and determine how a new immutable release and a guard against moving published tags should be handled. Done means downstream users have a reproducible replacement release and the affected v0.2.0 behavior is documented.

Written by the indexing model from the issue text.