Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/proxy_test.go

@@ -276,7 +276,11 @@ func startApp(t *testing.T, app http.HandlerFunc) *httptest.Server {
 // startProxy starts waf, and rproxy in front of the app at appURL, each with
 // the settings in env on top of the defaults, and returns where rproxy listens
 // and what waf writes.
-func startProxy(t *testing.T, appURL string, env map[string]string) (string, *output) {
+func startProxy(
+	t *testing.T,
+	appURL string,
+	env map[string]string,
+) (string, *output) {
 	t.Helper()
 
 	return startProxyWithGeoJS(t, appURL, "", env)
@@ -305,7 +309,13 @@ func startProxyWithClock(
 ) (string, *output, *waf.Server) {
 	t.Helper()
 
-	addr, out, server, _ := startProxyWithAlerts(t, appURL, geojsURL, now, env)
+	addr, out, server, _ := startProxyWithAlerts(
+		t,
+		appURL,
+		geojsURL,
+		now,
+		env,
+	)
 
 	return addr, out, server
 }
@@ -329,7 +339,11 @@ func startProxyWithAlerts(
 func serve(t *testing.T, server *waf.Server) {
 	t.Helper()
 
-	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	listener, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -361,11 +375,13 @@ func startRProxy(
 	}
 	maps.Copy(settings, env)
 
-	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
-		value, ok := settings[name]
+	cfg, err := config.RProxyFromEnvironment(
+		func(name string) (string, bool) {
+			value, ok := settings[name]
 
-		return value, ok
-	})
+			return value, ok
+		},
+	)
 	if err != nil {
 		t.Fatalf("settings %v: %v", settings, err)
 	}
@@ -373,10 +389,18 @@ func startRProxy(
 	server := rproxy.New(rproxy.Params{
 		Config:     cfg,
 		RequestLog: io.Discard,
-		ProcessLog: requestlog.NewProcessLogger(io.Discard, "rproxy", slog.LevelInfo),
+		ProcessLog: requestlog.NewProcessLogger(
+			io.Discard,
+			"rproxy",
+			slog.LevelInfo,
+		),
 	})
 
-	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	listener, err := (&net.ListenConfig{}).Listen(
+		t.Context(),
+		"tcp",
+		localhost+":0",
+	)
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -403,7 +427,10 @@ func startRProxy(
 // env sets it, so that only the tests of the Core Rule Set have their requests
 // inspected by it.
 func newWAF(
-	t *testing.T, geojsURL string, now func() time.Time, env map[string]string,
+	t *testing.T,
+	geojsURL string,
+	now func() time.Time,
+	env map[string]string,
 ) (*waf.Server, *output, *alerts.Queue) {
 	t.Helper()
 
@@ -436,7 +463,11 @@ func newWAFWith(
 	}
 
 	out := &output{}
-	processLog := requestlog.NewProcessLogger(out, cfg.InstanceName, cfg.LogLevel)
+	processLog := requestlog.NewProcessLogger(
+		out,
+		cfg.InstanceName,
+		cfg.LogLevel,
+	)
 
 	ruleFiles, err := rules.Load(rules.Params{
 		Dir: cfg.RulesDir, Enabled: cfg.RulesEnabled, ProcessLog: processLog,
@@ -513,14 +544,28 @@ func readAnswer(res *http.Response) answer {
 	body, err := io.ReadAll(res.Body)
 	_ = res.Body.Close()
 
-	return answer{status: res.StatusCode, header: res.Header, body: body, err: err}
+	return answer{
+		status: res.StatusCode,
+		header: res.Header,
+		body:   body,
+		err:    err,
+	}
 }
 
 // newRequest makes a request for path to addr, where rproxy or waf listens.
-func newRequest(t *testing.T, method, addr, path string, body io.Reader) *http.Request {
+func newRequest(
+	t *testing.T,
+	method, addr, path string,
+	body io.Reader,
+) *http.Request {
 	t.Helper()
 
-	req, err := http.NewRequestWithContext(t.Context(), method, "http://"+addr+path, body)
+	req, err := http.NewRequestWithContext(
+		t.Context(),
+		method,
+		"http://"+addr+path,
+		body,
+	)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}