>>the Go answer to version control of dependencies seems to be "clone the head of the master branch of a Github repo"

Yes and it is only the fault of these devs that they did not do that. One of the first things I did when starting a job programming Go full time was go- woah, we need to clone our dependencies so we can manage upgrades. It was just common sense and easy.

How does that work with transitive dependencies? If my app uses A, which in turn uses B, do I fork A and B and then edit all of the imports in my local fork of A to now point to my fork of B? When I take new drops of A, do I have to make sure my locally changed imports don't get borked?

That's just non-sense. The issues were caused by exactly that. Multiple people cloned the head at different times and things broke.

They obviously didn't snapshot their dependencies into a git repo they shared, you meant they cloned them locally, which is not what I meant at all.