Pin the remaining developer tool installs (closes #68)

gofumpt was pinned only by its version tag. It is now a tool of a
separate module in tools/, so `go tool` builds it from source checked
against the hashes in tools/go.sum, and mfer's own module gains no
dependencies. script/prettier no longer falls back to a prettier on
PATH, and fails when node_modules holds a different version than
package.json pins. The bootstrap comment now says what --frozen-lockfile
really does, package.json drops its made-up version, and the golang
image comment names its exact version.

Model: opus-5-5

script/gofumpt

@@ -10,10 +10,9 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# gofumpt v0.12.0, 2026-10-04. `go run` fetches and builds exactly this
-# version, so neither a developer machine nor the lint image needs
-# gofumpt installed.
-GOFUMPT="mvdan.cc/gofumpt@v0.12.0"
+# gofumpt v0.12.0, 2026-10-04, required by tools/go.mod. `go tool` run in
+# tools/ builds it from source checked against the hashes in tools/go.sum,
+# so neither a developer machine nor the lint image needs it installed.
 
 usage() {
     echo "usage: script/gofumpt --write|--check" >&2
@@ -22,15 +21,15 @@ usage() {
 
 main() {
     [ "$#" -eq 1 ] || usage
-    cd "$ROOT"
-    # Every Go file in the repo. gofumpt holds generated files, such as
-    # mfer/mf.pb.go, to gofmt's rules only.
+    cd "$ROOT/tools"
+    # Every Go file in the repo, from $ROOT down. gofumpt holds generated
+    # files, such as mfer/mf.pb.go, to gofmt's rules only.
     case "$1" in
-        --write) go run "$GOFUMPT" -l -w . ;;
+        --write) go tool gofumpt -l -w "$ROOT" ;;
         --check)
             # Own line: a failing command inside `[ -n "$(...)" ]` does
             # not trip `set -e`, so a gofumpt that never ran would pass.
-            unformatted="$(go run "$GOFUMPT" -l .)"
+            unformatted="$(go tool gofumpt -l "$ROOT")"
             if [ -n "$unformatted" ]; then
                 echo "gofumpt: files need formatting (run make fmt):" >&2
                 echo "$unformatted" >&2