Depend on tagged Reef v0.1.8

Drops the local replace and the CI step that checked out Reef.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -11,21 +11,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Sandbar needs secretbox, which is not in a tagged Reef release yet. Build against Reef's
-      # main branch until it is, then delete this step and the replace line in go.mod.
-      - uses: actions/checkout@v4
-        with:
-          repository: Veillax/reef
-          path: reef-src
-          token: ${{ secrets.REEF_TOKEN }}
-
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
 
-      - name: Use the checked-out Reef
-        run: go mod edit -replace git.veillax.com/Veillax/reef=./reef-src
-
       - name: Formatting
         run: |
           unformatted=$(gofmt -l cmd internal)

go.mod

@@ -3,7 +3,7 @@ module git.veillax.com/Veillax/sandbar
 go 1.27.3
 
 require (
-	git.veillax.com/Veillax/reef v0.1.7
+	git.veillax.com/Veillax/reef v0.1.8
 	golang.org/x/crypto v0.58.0
 	modernc.org/sqlite v1.61.0
 )
@@ -19,6 +19,3 @@ require (
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.12.1 // indirect
 )
-
-// Local development against an unreleased Reef (it gains secretbox). Remove once Reef is tagged.
-replace git.veillax.com/Veillax/reef => ../reef

go.sum

@@ -1,3 +1,5 @@
+git.veillax.com/Veillax/reef v0.1.8 h1:RfTKu2hGVHy+pzB2/3zk7SEvDr5QKsaqIYEkF74B2Ns=
+git.veillax.com/Veillax/reef v0.1.8/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
 github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
 github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
 github.com/google/pprof v0.0.0-20261016150608-1facf8f91b50 h1:PlNWJRxu5APSV0pWqfIsZ0qt9OOGHSWfZQ4zvx+WgWs=