fix(operator): COPY in-module deps (pkg/envelope, pkg/zap) into build context

zapclient imports github.com/luxfi/kms/pkg/{envelope,zap}, which are the
module's own packages. -mod=vendor only vendors external deps, so these
must be present in the Docker build context as source. The selective COPY
missed them, so the build failed:

  pkg/zapclient/client.go:34:2: cannot find module providing package
    github.com/luxfi/kms/pkg/envelope: import lookup disabled by -mod=vendor

COPY both packages; also add them to the workflow paths filter so the
operator image rebuilds when they change.

.github/workflows/build-operator.yml

@@ -14,6 +14,8 @@ on:
     paths:
       - 'cmd/kms-operator/**'
       - 'pkg/zapclient/**'
+      - 'pkg/envelope/**'
+      - 'pkg/zap/**'
       - 'Dockerfile.operator'
       - '.github/workflows/build-operator.yml'
     tags: ['v*']

Dockerfile.operator

@@ -17,7 +17,11 @@ WORKDIR /build
 COPY go.mod go.sum ./
 COPY vendor ./vendor
 COPY cmd/kms-operator ./cmd/kms-operator
+# zapclient and its in-module deps (envelope, zap) — vendor only carries
+# external deps, so the module's own packages must be in the build context.
 COPY pkg/zapclient ./pkg/zapclient
+COPY pkg/envelope ./pkg/envelope
+COPY pkg/zap ./pkg/zap
 
 RUN CGO_ENABLED=0 go build -mod=vendor \
     -ldflags="-s -w" -o /usr/local/bin/kms-operator ./cmd/kms-operator