Pin the remaining developer tool installs (closes #68)

gofumpt was pinned only by its version tag. It is now a tool of a
separate module in tools/, so `go tool` builds it from source checked
against the hashes in tools/go.sum, and mfer's own module gains no
dependencies. script/prettier no longer falls back to a prettier on
PATH, and fails when node_modules holds a different version than
package.json pins. The bootstrap comment now says what --frozen-lockfile
really does, package.json drops its made-up version, and the golang
image comment names its exact version.

Model: opus-5-5

README.md

@@ -99,9 +99,10 @@ provide:
 - `script/fmt` — format all code and docs (writes): `script/gofumpt --write` and
   `script/prettier --write`
 - `script/gofumpt` — run `gofumpt` over every Go file in the repository in the
-  given mode, `--write` or `--check`, at the one version it pins (built on
-  demand by `go run`, so nothing installs it); `script/fmt`, `script/fmt-check`
-  and the Docker lint stage all go through it, so they cannot disagree about Go
+  given mode, `--write` or `--check`, at the version `tools/go.mod` requires
+  (built on demand by `go tool` from source checked against the hashes in
+  `tools/go.sum`, so nothing installs it); `script/fmt`, `script/fmt-check` and
+  the Docker lint stage all go through it, so they cannot disagree about Go
   formatting
 - `script/prettier` — run prettier over the repository's canonical file set
   (Markdown and JSON, minus `.prettierignore`) in the given mode, `--write` or