Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/rulefiles.go

@@ -26,7 +26,11 @@ type ruleFiles struct{}
 
 func (ruleFiles) name() string { return "rule_files" }
 
-func (ruleFiles) check(_ context.Context, rq *request, now time.Time) *verdict {
+func (ruleFiles) check(
+	_ context.Context,
+	rq *request,
+	now time.Time,
+) *verdict {
 	matched := rq.h.rules.Match(rq.in)
 
 	for _, rule := range matched {
@@ -48,12 +52,18 @@ func (ruleFiles) check(_ context.Context, rq *request, now time.Time) *verdict {
 	case rules.ActionBlock:
 		rq.blockedByBlockRule = true
 
-		return &verdict{action: requestlog.ActionBlockedByBlockRule, figures: figures}
+		return &verdict{
+			action:  requestlog.ActionBlockedByBlockRule,
+			figures: figures,
+		}
 	case rules.ActionBan:
 		rq.attack = true
 
 		return &verdict{
-			action:  rq.banForAttack(now, bans.Notes{RuleID: last.ID, Target: last.Target}),
+			action: rq.banForAttack(
+				now,
+				bans.Notes{RuleID: last.ID, Target: last.Target},
+			),
 			figures: figures,
 		}
 	default: