script/bootstrap installs a pinned Go so script/cibuild runs on the Gitea runner (closes #46)

script/cibuild runs script/bootstrap on the Gitea runner, which has Docker and git but no Go, and bootstrap could not install it: its apt path never ran apt-get update. Bootstrap now installs Go at the version in the Dockerfile's golang image from go.dev, checked against sha256 values in the script, into ~/.local/go whenever the go first on PATH reports another version; the Makefile and the fmt, fmt-check and precommit scripts put ~/.local/go/bin first on their PATH. apt-get update runs once before the first apt install. Bumping the golang digest now means bumping GO_VERSION and its four hashes.

Partially verified: checked in a clean ubuntu:24.04 container, not yet on the Gitea runner.

Model: opus-5-5

Makefile

@@ -5,6 +5,9 @@
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 LDFLAGS := -s -w -X 'sneak.berlin/go/keyfunc/internal/cli.Version=$(VERSION)'
 
+# Where script/bootstrap installs Go; it cannot put it on our PATH.
+export PATH := $(HOME)/.local/go/bin:$(PATH)
+
 .PHONY: default bootstrap setup build test lint fmt fmt-check check \
 	docker cibuild hooks clean