Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/coreruleset.go

@@ -25,9 +25,14 @@ type coreRuleSet struct{}
 
 func (coreRuleSet) name() string { return "core_rule_set" }
 
-func (coreRuleSet) check(_ context.Context, rq *request, _ time.Time) *verdict {
+func (coreRuleSet) check(
+	_ context.Context,
+	rq *request,
+	_ time.Time,
+) *verdict {
 	cfg := rq.h.config
-	if cfg.WAFMode == config.WAFModeOff || pathExempt(rq.in, cfg.WAFExemptPaths) {
+	if cfg.WAFMode == config.WAFModeOff ||
+		pathExempt(rq.in, cfg.WAFExemptPaths) {
 		return nil
 	}
 
@@ -38,7 +43,9 @@ func (coreRuleSet) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	result, read, _ := rq.h.coreRuleSet.Inspect(rq.in, rq.client, rq.in.Body)
 	rq.requestBytes = int64(len(read))
 
-	rq.line.DurationCoreRuleSetMS = new(requestlog.Milliseconds(time.Since(start)))
+	rq.line.DurationCoreRuleSetMS = new(
+		requestlog.Milliseconds(time.Since(start)),
+	)
 	rq.line.CoreRuleSetRuleIDs = result.RuleIDs
 	rq.line.CoreRuleSetScore = &result.Score
 
@@ -61,8 +68,11 @@ func (coreRuleSet) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	rq.blockedByCoreRuleSet = true
 
 	return &verdict{
-		action:  requestlog.ActionBlockedByCoreRuleSet,
-		figures: map[string]any{figureScore: result.Score, "threshold": threshold},
+		action: requestlog.ActionBlockedByCoreRuleSet,
+		figures: map[string]any{
+			figureScore: result.Score,
+			"threshold": threshold,
+		},
 	}
 }