CI: guard against importing from github.com/hyperledger/fabric/

[HagarMeir]

Summary

CI should fail if any (non-vendored) Go code imports from github.com/hyperledger/fabric/. Fabric-X should depend on hyperledger/fabric-x-common (and fabric-lib-go / fabric-protos-go-apiv2) instead of the monolithic hyperledger/fabric module.

Current state

• scripts/check_imports.sh already exists and runs in CI via make basic-checks → check-imports.
• However, it only guards a single package: github.com/hyperledger/fabric/protoutil (telling contributors to use github.com/hyperledger/fabric-x-common/protoutil).
• It also only inspects files changed vs origin/main, so a pre-existing import elsewhere would not be caught.

Today there are no github.com/hyperledger/fabric/ imports in the tree, so this is about locking in that invariant.

Proposed change

Generalize the import guard to reject any import path under github.com/hyperledger/fabric/ (while still allowing fabric-x-*, fabric-lib-go, fabric-protos-go-apiv2, etc.), covering the whole repo rather than just the diff.

Sketch:

# match "github.com/hyperledger/fabric/..." but not fabric-x, fabric-lib-go, fabric-protos-...
found=$(grep -rn 'github.com/hyperledger/fabric/' --include='*.go' . \
  | grep -v '/vendor/' || true)

if [ -n "$found" ]; then
  echo "The following files import from github.com/hyperledger/fabric/:"
  echo "$found"
  echo "Use github.com/hyperledger/fabric-x-common (or fabric-lib-go / fabric-protos-go-apiv2) instead."
  exit 1
fi

The existing protoutil-specific message can be kept as a more helpful hint when that particular package is matched.

Acceptance criteria

• CI fails when any non-vendored .go file imports from github.com/hyperledger/fabric/.
• Allowed prefixes (fabric-x-*, fabric-lib-go, fabric-protos-go-apiv2, fabric-config, fabric-admin-sdk, …) are not flagged.
• The check scans the whole repository, not only files changed vs origin/main.
• Failure output lists offending files and points to the fabric-x-common replacement.