Alright, I think I have found the issue.  https://go.dev/ref/mod says:

> If a module is defined in a subdirectory within the repository, that is,
> the module subdirectory portion of the module path is not empty, then each
> tag name must be prefixed with the module subdirectory, followed by a slash.
> For example, the module golang.org/x/tools/gopls is defined in the gopls
> subdirectory of the repository with root path golang.org/x/tools. The version
> v0.4.0 of that module must have the tag named gopls/v0.4.0 in that repository.

Right now the importer code assumes that either we have a pseudo version (and
thus can extract a raw commit hash) or else that the tag will be exactly
(string-append "v" version) but this does not take into account the rule about
subdirectory packages.