feat: use vend for vendoring instead of go mod vendor

go mod vendor doesn't include the entire source of the vendored
dependencies, which breaks some of our deps that use cgo.

also extracts the "check if at repo root" check that's used in several
scripts into a module arg, for easier reuse.