Replace Directives — Stale Dependent Modules

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

gomod

### Package manager version

Go 1.25

### Language version

Go 1.25

### Manifest location and content before the Dependabot update

Can't provide a link but this is the structure:

Repository has multiple Go modules with replace directives:

/src/training/training-operator/go.mod
/src/inference/inference-model-synthetic/go.mod (has: replace training-operator => ../../training/training-operator)
/src/network/manifold-npm/go.mod
/src/inference/template-deployer/go.mod (has: replace manifold-npm => ../../network/manifold-npm)

### dependabot.yml content

version: 2
updates:
- package-ecosystem: "gomod"
directories:
- /src/**/*
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major", "version-update:semver-minor"]

### Updated dependency

google.golang.org/grpc from 1.75.1 to 1.79.3 in /src/training/training-operator
google.golang.org/grpc from 1.72.1 to 1.79.3 in /src/network/manifold-npm

### What you expected to see, versus what you actually saw

Expected: Dependabot updates [go.mod](vscode-file://vscode-app/c:/Users/pbettadapura/AppData/Local/Programs/Microsoft%20VS%20Code/ce099c1ed2/resources/app/out/vs/code/electron-browser/workbench/workbench.html) and go.sum in the target module AND runs go mod tidy on sibling modules that reference the target via replace directives, so the PR builds successfully.

Actual: Dependabot only updates [go.mod](vscode-file://vscode-app/c:/Users/pbettadapura/AppData/Local/Programs/Microsoft%20VS%20Code/ce099c1ed2/resources/app/out/vs/code/electron-browser/workbench/workbench.html) and go.sum in the target module. Sibling modules with replace directives pointing to the target now have stale go.sum files — missing checksums for new transitive dependencies. The build fails with errors like:

`go: module-b/go.sum: missing go.sum entry for module providing package X`

### Native package manager behavior

Running go mod tidy manually in each dependent module after the bump resolves the issue. The native Go toolchain handles this correctly when you run go mod tidy across all affected modules.

### Images of the diff or a link to the PR, issue, or logs

The pattern is reproducible in any multi-module Go repo with replace directives.

### Smallest manifest that reproduces the issue

repo/
├── module-a/
│ └── go.mod:
│ module example.com/module-a
│ go 1.22
│ require google.golang.org/grpc v1.60.0
│
└── module-b/
└── go.mod:
module example.com/module-b
go 1.22
require example.com/module-a v0.0.0
replace example.com/module-a => ../module-a

When Dependabot bumps grpc in module-a, module-b/go.sum becomes stale because it's missing checksums for grpc's new transitive dependencies.