Pin the remaining developer tool installs (closes #68)

gofumpt and protoc-gen-go are tools of a separate Go module in bin/tools,
so `go tool` builds them from source checked against bin/tools/go.sum and
mfer's own module gains no dependencies. script/bootstrap downloads that
module, and unpacks protoc 33.4 into bin/protoc from its release archive
after checking the sha256 it holds for the platform. script/generate runs
that protoc with the pinned plugin, so mfer/mf.go and its go:generate line
go. script/prettier runs only the node_modules prettier, fails when it
differs from the package.json pin, finds the node bootstrap installed
through nvm by the version in .nvmrc, and runs prettier once. Comment and
package.json fixes.

Model: opus-5-5

bin/tools/go.mod

@@ -0,0 +1,22 @@
+// The developer tools this repo runs with `go tool`: gofumpt for
+// script/gofumpt and protoc-gen-go for script/generate. Kept out of the mfer
+// module so they add nothing to what mfer's users download. `go tool` builds
+// exactly the source whose hashes go.sum here records.
+module sneak.berlin/go/mfer/bin/tools
+
+go 1.26.0
+
+tool (
+	google.golang.org/protobuf/cmd/protoc-gen-go
+	mvdan.cc/gofumpt
+)
+
+require (
+	golang.org/x/mod v0.40.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
+	// protoc-gen-go v1.36.11, 2026-10-04
+	google.golang.org/protobuf v1.36.11 // indirect
+	// gofumpt v0.12.0, 2026-10-04
+	mvdan.cc/gofumpt v0.12.0 // indirect
+)