Pin the remaining developer tool installs (closes #68)

gofumpt and protoc-gen-go are tools of a separate Go module in bin/tools,
so `go tool` builds them from source checked against bin/tools/go.sum and
mfer's own module gains no dependencies. script/bootstrap downloads that
module, and unpacks protoc 33.4 into bin/protoc from its release archive
after checking the sha256 it holds for the platform. script/generate runs
that protoc with the pinned plugin, so mfer/mf.go and its go:generate line
go. script/prettier runs only the node_modules prettier, fails when it
differs from the package.json pin, finds the node bootstrap installed
through nvm by the version in .nvmrc, and runs prettier once. Comment and
package.json fixes.

Model: opus-5-5

Dockerfile

@@ -10,7 +10,7 @@ COPY . .
 
 # Go half of fmt-check only: this image has no node, so no prettier. The
 # markdown half runs in the mdfmt stage below. The image has no gofumpt
-# either; script/gofumpt builds the version it pins with `go run`.
+# either; script/gofumpt builds the version bin/tools/go.mod pins.
 RUN script/gofumpt --check
 # The linter directly, not `make lint`: script/lint builds this stage, and
 # there is no docker inside this build.
@@ -18,7 +18,7 @@ RUN golangci-lint run --config .golangci.yml ./...
 
 # Markdown/JSON format stage — prettier needs node, which the Go images
 # do not have. node:22.17.0-bookworm-slim (2026-08-09); ships node
-# 22.17.0 and yarn 1.22.22, the versions script/bootstrap pins.
+# 22.17.0 and yarn 1.22.22, the versions .nvmrc and script/bootstrap pin.
 FROM node@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0 AS mdfmt
 
 WORKDIR /src
@@ -31,7 +31,7 @@ COPY . .
 RUN script/prettier --check
 
 # Build stage — tests and compilation
-# golang:1.23 (2026-03-14)
+# golang:1.23.12, 2026-03-14
 FROM golang@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS builder
 
 # Force BuildKit to run the lint and mdfmt stages by creating stage dependencies