fmt: check goimports in fmt-check, run it at its pinned commit (#119)

script/fmt-check now runs goimports in list mode and fails naming any
file it would change, and checks gofmt with -s, as script/fmt applies
it. Both scripts run goimports with `go run` at the commit that
script/bootstrap used to install, so a goimports on PATH is never used
and bootstrap no longer installs it. The pin is written in both
scripts; change them together. The first run on a machine, and every
Dockerfile lint stage run, downloads and builds goimports.

The Markdown half of the issue (prettier) is not done here: it needs
node in the lint image or a separate build, a decision for the owner.

Model: opus-5-5

README.md

@@ -508,7 +508,7 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call
 them. We provide:
 
-- `script/bootstrap` — install all dependencies (go, pinned goimports,
+- `script/bootstrap` — install all dependencies (go,
   `go mod download`). It does not install golangci-lint: see
   `script/lint` below.
 - `script/setup` — make a fresh clone ready for development: bootstrap
@@ -527,8 +527,10 @@ them. We provide:
   host, and Docker is the only prerequisite. Caching is waived for
   linting: the lint stage is forced to execute on every run with
   `--no-cache-filter`, because a cached build lints nothing.
-- `script/fmt` — format all code (gofmt -s, goimports)
-- `script/fmt-check` — check formatting (read-only)
+- `script/fmt` — format all code (gofmt -s, goimports). goimports runs
+  with `go run` at a pinned commit, never from your `PATH`.
+- `script/fmt-check` — check formatting (read-only) with the same tools,
+  failing on any file `script/fmt` would change
 - `script/check` — run test, lint, and fmt-check
 - `script/docker` — build the Docker image tagged via `script/projectname`, with
   `--no-cache-filter=lint,builder` so the lint stage and the builder stage,