script/bootstrap installs a pinned Go so script/cibuild runs on the Gitea runner (closes #46)

script/cibuild runs script/bootstrap on the Gitea runner, which has Docker and git but no Go, and bootstrap could not install it: its apt path never ran apt-get update. Bootstrap now installs Go at the version in the Dockerfile's golang image from go.dev, checked against sha256 values in the script, into ~/.local/go whenever the go first on PATH reports another version; the Makefile and the fmt, fmt-check and precommit scripts put ~/.local/go/bin first on their PATH. apt-get update runs once before the first apt install. Bumping the golang digest now means bumping GO_VERSION and its four hashes.

Partially verified: checked in a clean ubuntu:24.04 container, not yet on the Gitea runner.

Model: opus-5-5

Dockerfile

@@ -17,7 +17,8 @@ COPY . .
 RUN golangci-lint run --config .golangci.yml ./...
 
 # Test phase
-# golang:1.26-alpine, 2026-09-07
+# golang:1.26-alpine, 2026-09-07. It carries Go 1.26.8, the version
+# script/bootstrap installs on the host; change both together.
 FROM golang@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628 AS test
 
 # -race needs cgo, and cgo needs a C toolchain.