Usually, if you are not modifying your code, I think go.mod should be stable across repeated identical invocations of something like 'go build' or 'go install'.
I think there were a similar sounding set of bugs fixed for Go 1.13, but sounds like you are seeing this with Go 1.13.
That particular bug has seemingly been fixed in the tip branch. It probably is worth trying to see if you can reproduce with that fix in place. A handy way to try with the latest from tip / master is:
$ gotip download
However, that might not solve it for you.
If you still see the same behavior using 'gotip', then I would suggest opening a new bug to make sure one of the people working on cmd/go takes a look. It looks like you already have nicely pulled together a public reproducer, which is great.
Finally, does 'go mod tidy' seem to be stable in terms of how it leaves go.mod? If so, one approach in the short term might be to run 'go mod tidy' to put go.mod into a more stable state (e.g., after running 'go install'), but given you seem to be seeing a bug, I'm not sure if that will work for you.
Regards,
thepudds