Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/anomaly/anomaly.go

@@ -43,7 +43,13 @@ const (
 
 // Scopes returns every scope.
 func Scopes() []string {
-	return []string{ScopeClient, ScopeNet, ScopeASN, ScopeTotal, ScopeWatchedNet}
+	return []string{
+		ScopeClient,
+		ScopeNet,
+		ScopeASN,
+		ScopeTotal,
+		ScopeWatchedNet,
+	}
 }
 
 // The windows a counter counts in, as the alerts name them.
@@ -191,8 +197,12 @@ func (c *Counters) Snapshot() []Counter {
 	c.mu.Unlock()
 
 	slices.SortFunc(counters, func(a, b Counter) int {
-		return cmp.Or(cmp.Compare(a.Scope, b.Scope), a.Netblock.Compare(b.Netblock),
-			cmp.Compare(a.ASN, b.ASN), cmp.Compare(a.Name, b.Name))
+		return cmp.Or(
+			cmp.Compare(a.Scope, b.Scope),
+			a.Netblock.Compare(b.Netblock),
+			cmp.Compare(a.ASN, b.ASN),
+			cmp.Compare(a.Name, b.Name),
+		)
 	})
 
 	return counters
@@ -257,7 +267,11 @@ func (c *Counters) scopesOf(r Request) []scope {
 	for _, named := range p.NamedNetblocks {
 		if named.Netblock.Contains(client) {
 			all = append(all, scope{
-				key{scope: ScopeWatchedNet, netblock: named.Netblock, name: named.Name}, p.Watch,
+				key{
+					scope:    ScopeWatchedNet,
+					netblock: named.Netblock,
+					name:     named.Name,
+				}, p.Watch,
 			})
 		}
 	}
@@ -316,7 +330,12 @@ func (c *Counter) add(
 
 		counted := count.buckets.Add(now, count.length, n)
 		if !passed && counted > float64(threshold) {
-			first = overThreshold{count.kind, count.window, counted, threshold}
+			first = overThreshold{
+				count.kind,
+				count.window,
+				counted,
+				threshold,
+			}
 			passed = true
 		}
 	}
@@ -359,12 +378,22 @@ func (c *Counter) lastStart() time.Time {
 
 // key returns what tells c from the other counters.
 func (c *Counter) key() key {
-	return key{scope: c.Scope, netblock: c.Netblock, asn: c.ASN, name: c.Name}
+	return key{
+		scope:    c.Scope,
+		netblock: c.Netblock,
+		asn:      c.ASN,
+		name:     c.Name,
+	}
 }
 
 // counter returns a counter for k, with nothing counted yet.
 func (k key) counter() *Counter {
-	return &Counter{Scope: k.scope, Netblock: k.netblock, ASN: k.asn, Name: k.name}
+	return &Counter{
+		Scope:    k.scope,
+		Netblock: k.netblock,
+		ASN:      k.asn,
+		Name:     k.name,
+	}
 }
 
 // alertFor returns the anomaly alert for o, a count over its threshold in
@@ -404,8 +433,13 @@ func alertFor(r Request, k key, o overThreshold) alerts.Alert {
 		ASN:      r.ASN,
 		ASName:   r.ASName,
 		Country:  r.Country,
-		Reason: fmt.Sprintf("%s per %s of %s over the threshold of %d", o.kind, o.window,
-			counted, o.threshold),
+		Reason: fmt.Sprintf(
+			"%s per %s of %s over the threshold of %d",
+			o.kind,
+			o.window,
+			counted,
+			o.threshold,
+		),
 		Detail: detail,
 	}
 }