Pin the remaining developer tool installs (closes #68)

gofumpt and protoc-gen-go are tools of a separate Go module in bin/tools,
so `go tool` builds them from source checked against bin/tools/go.sum and
mfer's own module gains no dependencies. script/bootstrap downloads that
module, and unpacks protoc 33.4 into bin/protoc from its release archive
after checking the sha256 it holds for the platform. script/generate runs
that protoc with the pinned plugin, so mfer/mf.go and its go:generate line
go. script/prettier runs only the node_modules prettier, fails when it
differs from the package.json pin, finds the node bootstrap installed
through nvm by the version in .nvmrc, and runs prettier once. Comment and
package.json fixes.

Model: opus-5-5

README.md

@@ -67,9 +67,13 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call them. We
 provide:
 
-- `script/bootstrap` — install all dependencies (Go, Go module download, and
-  node/yarn plus the prettier version pinned in `package.json`/`yarn.lock`),
-  idempotently; golangci-lint is not installed, it runs only in Docker
+- `script/bootstrap` — install all dependencies, idempotently: Go and the
+  modules of both `go.mod` and `bin/tools/go.mod`; node (the version `.nvmrc`
+  names, through nvm when there is no node on `PATH`) and yarn, plus the
+  prettier version pinned in `package.json`/`yarn.lock`; and `protoc` 33.4,
+  unpacked into `bin/protoc` from its release archive once the archive matches
+  the sha256 the script holds for this platform. golangci-lint is not installed,
+  it runs only in Docker
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (`mfer`); used by other scripts
@@ -82,14 +86,10 @@ provide:
 - `script/generate` (`make generate`) — regenerate `mfer/mf.pb.go` from
   `mfer/mf.proto` and record the hash of that `mfer/mf.proto` in
   `mfer/mf.proto.sha256`; the only thing that regenerates the committed
-  `mfer/mf.pb.go`. It needs the exact versions that wrote the committed file,
-  and refuses to run with any other: `protoc` 33.4 (unpack
-  `protoc-33.4-<platform>.zip` from
-  [its release](https://github.com/protocolbuffers/protobuf/releases/tag/v33.4)
-  and put its `bin/protoc` on `PATH`) and `protoc-gen-go` v1.36.11
-  (`go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.11`, which
-  installs it in `$(go env GOPATH)/bin`; `script/generate` adds that directory
-  to `PATH`)
+  `mfer/mf.pb.go`. It runs the `protoc` that `script/bootstrap` unpacks into
+  `bin/protoc`, refusing any version but 33.4, and the `protoc-gen-go` that
+  `bin/tools/go.mod` pins, which `go tool` builds from source checked against
+  the hashes in `bin/tools/go.sum`
 - `script/fuzz` — fuzz the manifest parser for one minute; run by hand
   (`make fuzz`), never by CI, while `script/test` runs its committed seed corpus
   as ordinary tests
@@ -99,14 +99,17 @@ provide:
 - `script/fmt` — format all code and docs (writes): `script/gofumpt --write` and
   `script/prettier --write`
 - `script/gofumpt` — run `gofumpt` over every Go file in the repository in the
-  given mode, `--write` or `--check`, at the one version it pins (built on
-  demand by `go run`, so nothing installs it); `script/fmt`, `script/fmt-check`
+  given mode, `--write` or `--check`, at the version `bin/tools/go.mod` pins
+  (built on demand by `go tool` from source checked against the hashes in
+  `bin/tools/go.sum`, so nothing installs it); `script/fmt`, `script/fmt-check`
   and the Docker lint stage all go through it, so they cannot disagree about Go
   formatting
 - `script/prettier` — run prettier over the repository's canonical file set
   (Markdown and JSON, minus `.prettierignore`) in the given mode, `--write` or
-  `--check`; the single definition of that file set, so `script/fmt` and
-  `script/fmt-check` cannot disagree about it
+  `--check`, with the prettier version `yarn.lock` pins, run by the node on
+  `PATH` or else the one `script/bootstrap` installed through nvm; the single
+  definition of that file set, so `script/fmt` and `script/fmt-check` cannot
+  disagree about it
 - `script/fmt-check` — check formatting without writing:
   `script/gofumpt --check` plus `script/prettier --check`
 - `script/check` — run `script/test`, `script/lint`, and `script/fmt-check`