script/bootstrap installs the Dockerfile's Go from go.dev (closes #46)

The Gitea runner has Docker and git but no Go, and the apt path never
ran apt-get update, so on a fresh host every install failed.

Bootstrap now installs Go 1.26.8, the version in the Dockerfile's
golang image, from the release archive at go.dev, checked against a
sha256 in the script, into ~/.local/go whenever the go first on PATH
reports any other version. script/fmt, script/fmt-check,
script/precommit and the Makefile put ~/.local/go/bin first on their
PATH so they use it. The apt path runs apt-get update once, before its
first install.

Model: opus-5-5

Makefile

@@ -5,6 +5,9 @@
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 LDFLAGS := -s -w -X 'sneak.berlin/go/keyfunc/internal/cli.Version=$(VERSION)'
 
+# Where script/bootstrap installs Go; it cannot put it on our PATH.
+export PATH := $(HOME)/.local/go/bin:$(PATH)
+
 .PHONY: default bootstrap setup build test lint fmt fmt-check check \
 	docker cibuild hooks clean