A dispute over fsnotify maintainer access set off supply chain alarms around one of Go’s most widely used filesystem libraries.