chore(cleanup): deploy-audit fixes — Makefile, Dockerfile, compose, smoke, externals

[Patel230]

Summary

Fixes all outstanding issues from the deploy audit across hawk:

Changes

• Makefile: fix make setup go.work template — wrote module hawk-eco (invalid), now writes go 1.26.4
• Dockerfile: add ARG VERSION COMMIT BUILD_DATE and use them in ldflags; remove broken git describe fallback (.git excluded by .dockerignore)
• docker-compose.yml: add command: ["daemon", "start", "--host", "0.0.0.0", "--port", "4590"] so the container runs the daemon instead of --help
• smoke-hawk.sh: remove dead hawk yaad --limit 2 calls — yaad is a separate binary, not a hawk subcommand
• size-check: bump threshold from 50MB to 100MB (CI already uses 100MB)
• external/: sync all 6 submodules to latest main commits (incorporates tok chore(submodules): bump eyrie to 5aa1a4f (lefthook co-author strip) #56, eyrie refactor: replace context.TODO() with context.Background() and harden CI/CD #26, yaad ci: update docker and codeql actions #19 merges)

Verification

• go build ./... ✅
• go vet ./... ✅
• gofumpt -l . — clean
• goimports -l . — clean
• Local tests pass

[Patel230]

Self-review (can't approve own PR):

All 17 CI checks pass ✅

• ✅ format, lint, vet, deadcode, duplication, module hygiene, secrets, markdown
• ✅ test (race + coverage), fuzz (60s), smoke
• ✅ build (darwin/amd64, darwin/arm64, linux/amd64, linux/arm64, windows/amd64)
• ✅ build-and-push (Docker multi-arch image)

Changes are clean, minimal, and verified by CI. Merging.