fmt: check goimports in fmt-check, run it at its pinned commit (#119)

script/fmt-check now runs goimports in list mode and fails naming any
file it would change, and checks gofmt with -s, as script/fmt applies
it. Both scripts run goimports with `go run` at the commit that
script/bootstrap used to install, so a goimports on PATH is never used
and bootstrap no longer installs it. The pin is written in both
scripts; change them together. The first run on a machine, and every
Dockerfile lint stage run, downloads and builds goimports.

The Markdown half of the issue (prettier) is not done here: it needs
node in the lint image or a separate build, a decision for the owner.

Model: opus-5-5

README.md

@@ -508,9 +508,8 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call
 them. We provide:
 
-- `script/bootstrap` — install all dependencies (go, pinned goimports,
-  `go mod download`). It does not install golangci-lint: see
-  `script/lint` below.
+- `script/bootstrap` — install all dependencies (go, `go mod download`).
+  It does not install golangci-lint: see `script/lint` below.
 - `script/setup` — make a fresh clone ready for development: bootstrap
   plus the git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker
@@ -527,8 +526,10 @@ them. We provide:
   host, and Docker is the only prerequisite. Caching is waived for
   linting: the lint stage is forced to execute on every run with
   `--no-cache-filter`, because a cached build lints nothing.
-- `script/fmt` — format all code (gofmt -s, goimports)
-- `script/fmt-check` — check formatting (read-only)
+- `script/fmt` — format all code (gofmt -s, goimports). goimports runs
+  with `go run` at a pinned commit, never from your `PATH`.
+- `script/fmt-check` — check formatting (read-only) with the same tools,
+  failing on any file `script/fmt` would change
 - `script/check` — run test, lint, and fmt-check
 - `script/docker` — build the Docker image tagged via `script/projectname`, with
   `--no-cache-filter=lint,builder` so the lint stage and the builder stage,