script/bootstrap installs a pinned Go so script/cibuild runs on the Gitea runner (closes #46)

script/cibuild runs script/bootstrap on the Gitea runner, which has Docker and git but no Go, and bootstrap could not install it: its apt path never ran apt-get update. Bootstrap now installs Go at the version in the Dockerfile's golang image from go.dev, checked against sha256 values in the script, into ~/.local/go whenever the go first on PATH reports another version; the Makefile and the fmt, fmt-check and precommit scripts put ~/.local/go/bin first on their PATH. apt-get update runs once before the first apt install. Bumping the golang digest now means bumping GO_VERSION and its four hashes.

Partially verified: checked in a clean ubuntu:24.04 container, not yet on the Gitea runner.

Model: opus-5-5

README.md

@@ -283,9 +283,13 @@ The repo adheres to the
 standard: most Makefile targets are thin shims over an executable in
 `script/` (`build` and `clean` are the exceptions).
 
-- `script/bootstrap` installs everything needed to build and develop (git, make,
-  Go), idempotently, from nix, apt, brew or apk; it does not install the linter,
-  which only runs inside Docker.
+- `script/bootstrap` installs everything needed to build and develop,
+  idempotently: git and make from nix, apt, brew or apk, and Go, at the version
+  the `Dockerfile`'s Go image carries, from the official release archive
+  (checked against a sha256 in the script) into `~/.local/go`. `script/fmt`,
+  `script/fmt-check`, `script/precommit` and the `Makefile` put
+  `~/.local/go/bin` first on their `PATH`, so they use that Go. It does not
+  install the linter, which only runs inside Docker.
 - `script/setup` prepares a fresh clone: it runs `bootstrap`, then installs the
   git pre-commit hook.
 - `script/projectname` prints the project name; other scripts call it so they