Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

script/bootstrap

@@ -6,8 +6,9 @@
 # used directly if installed; otherwise it is installed at a pinned
 # version via nvm (installing nvm itself first, from a hash-verified
 # release archive, never curl | sh). Go comes from the package manager,
-# for gofmt in script/fmt and script/fmt-check: the tests and the linter
-# run in docker and need no Go on the host.
+# for gofmt and golines in script/fmt and script/fmt-check: the tests
+# and the linter run in docker and need no Go on the host. golines is
+# installed with go install at a pinned commit.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -18,6 +19,9 @@ NVM_VERSION="0.40.3"
 # sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
 NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
 YARN_VERSION="1.22.22"
+# golines v0.13.0, 2025-08-21
+GOLINES_VERSION="v0.13.0"
+GOLINES_COMMIT="8f32f0f7e89c30f572c7f2cd3b2a48016b9d8bbf"
 
 PKGMGR=""
 SUDO=""
@@ -117,6 +121,23 @@ ensure_yarn() {
     fi
 }
 
+# go install writes to GOBIN, or to GOPATH/bin when GOBIN is unset,
+# whether or not that is on the PATH. script/fmt and script/fmt-check
+# run golines from the same place, never another copy on the PATH.
+# golines --version prints "vdev" for a binary go install built, so
+# the version comes from the module line go version -m prints.
+ensure_golines() {
+    gobin="$(go env GOBIN)"
+    golines="${gobin:-$(go env GOPATH)/bin}/golines"
+    if [ -x "$golines" ]; then
+        installed="$(go version -m "$golines" | awk '$1 == "mod" { print $3 }')"
+        if [ "$installed" = "$GOLINES_VERSION" ]; then
+            return 0
+        fi
+    fi
+    go install "github.com/segmentio/golines@$GOLINES_COMMIT"
+}
+
 install_js_deps() {
     if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
         nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
@@ -132,8 +153,9 @@ main() {
     if missing make; then pkg_install gnumake make make make; fi
     if missing git; then pkg_install git git git git; fi
     if missing curl; then pkg_install curl curl curl curl; fi
-    if missing gofmt; then pkg_install go golang go go; fi
+    if missing go; then pkg_install go golang go go; fi
 
+    ensure_golines
     ensure_node
     ensure_yarn
     install_js_deps