fmt: check goimports in fmt-check, run it at its pinned commit (#119)

script/fmt-check now runs goimports in list mode and fails naming any
file it would change, and checks gofmt with -s, as script/fmt applies
it. Both scripts run goimports with `go run` at the commit that
script/bootstrap used to install, so a goimports on PATH is never used
and bootstrap no longer installs it. The pin is written in both
scripts; change them together. The first run on a machine, and every
Dockerfile lint stage run, downloads and builds goimports.

The Markdown half of the issue (prettier) is not done here: it needs
node in the lint image or a separate build, a decision for the owner.

Model: opus-5-5

script/bootstrap

@@ -3,9 +3,8 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes nothing is present.
-# goimports is installed via `go install` at a pinned commit (never
-# "latest") because script/fmt runs it on the host; script/fmt-check
-# does not (it runs gofmt only).
+# goimports is not installed here: script/fmt and script/fmt-check run
+# it with `go run` at a pinned commit.
 # The linter is NOT installed here: golangci-lint runs via docker only
 # (script/lint), pinned by image digest, so its only prerequisite is a
 # working docker.
@@ -13,10 +12,6 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Pinned version, 2026-08-07 (same pin as the Dockerfile)
-# goimports v0.42.0
-GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
-
 PKGMGR=""
 SUDO=""
 APT_UPDATED=""
@@ -71,10 +66,6 @@ main() {
     if missing make; then pkg_install gnumake make make make; fi
     if missing go; then pkg_install go golang go go; fi
 
-    # Format tools, pinned via go install (installs into
-    # "$(go env GOPATH)/bin"; ensure that is on your PATH).
-    if missing goimports; then go install "$GOIMPORTS_REF"; fi
-
     # Linting runs via docker only (script/lint). Warn, don't fail:
     # everything except `make lint` works without it.
     if missing docker; then