Introduce PR workflow to check modules are synced

Author: blewis12

.github/workflows/check-sync-module-dependencies.yml

@@ -0,0 +1,51 @@
+name: Check sync-module-dependencies
+permissions:
+  contents: read
+on: pull_request
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25.x'
+
+      - name: Cache Go build and modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Run sync-module-dependencies
+        run: |
+          make sync-module-dependencies
+
+      - name: Check for go.mod changes
+        run: |
+          # List changed go.mod files (added/modified/deleted)
+          CHANGED=$(git status --porcelain | awk '{print $2}' | grep -E '(^|/)go\.mod$' || true)
+
+          if [ -n "$CHANGED" ]; then
+            echo "::error::go.mod files are out of sync with sync-module-dependencies."
+            echo "The following go.mod files changed:"
+            echo "$CHANGED"
+            echo
+            echo "Diff:"
+            git --no-pager diff -- $CHANGED || true
+            echo
+            echo "To fix locally, run:"
+            echo "  (cd tools/sync-module-dependencies && go generate .)"
+            exit 1
+          fi