ops: add check-op-geth-version CI check

[joshklop]

Disclaimer: mostly co-written with Opus 4.5.

Add a tool that validates the go.mod replace directive points to a valid op-geth tag.

Runs as a separate CI job so failures are immediately visible in the GitHub UI, which is useful during op-geth merge windows when this check is expected to fail temporarily.

Also updates FindMonorepoRoot to verify the module path matches the optimism monorepo, preventing false positives when run from nested modules.

[wiz-inc-a178a98b5d]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	2
Software Management Findings	-
Total	2

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.64%. Comparing base (2a9e41e) to head (89cbde3).
⚠️ Report is 2074 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #18854      +/-   ##
===========================================
+ Coverage    73.25%   73.64%   +0.38%     
===========================================
  Files          190      190              
  Lines        11318    11318              
===========================================
+ Hits          8291     8335      +44     
+ Misses        2883     2839      -44     
  Partials       144      144              

Flag	Coverage Δ
cannon-go-tests-64	66.42% <ø> (ø)
contracts-bedrock-tests	77.63% <ø> (+0.60%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.