ci: gate Go formatting on gofmt

[stxkxs]

What

Enables the gofmt formatter in .golangci.yml, and brings the fourteen files that had drifted back into shape.

Why

Nothing checked Go formatting in this repo. golangci-lint ran with no formatter enabled, so task lint and the CI lint job were both blind to it — and files drifted without any gate noticing: struct-tag alignment, trailing-comment alignment, method-body alignment.

I found it the ordinary way: gofmt -w on a test file I was editing for an unrelated change also realigned a const block that was already unformatted on main.

Why golangci-lint rather than a CI step

golangci-lint run reports an unformatted file as an issue, so the command already wired into task lint and the CI lint job now fails on one. No new step, no new tool, and the local command stays identical to the CI command.

Proven before the cleanup, against the unformatted tree:

internal/audit/runner.go:33:1: File is not properly formatted (gofmt)
internal/baseline/baseline.go:17:1: File is not properly formatted (gofmt)
internal/certs/scanner_test.go:18:1: File is not properly formatted (gofmt)
3 issues:
* gofmt: 3

(exit 1; output caps at three of the same issue, there were fourteen)

The reformat is semantically inert

git diff -w over this change is empty — every Go edit is whitespace. No statement, signature, or tag value moves.

The fourteen files land in the same commit as the gate deliberately: a gate that lands red is a gate someone turns off.

Negative-tested

With the gate enabled, misaligning one trailing comment in internal/cost/diff.go:

state	golangci-lint run
clean	exit 0
one comment misaligned	exit 1
restored	exit 0

Verification

task build, task test (26 packages), task lint (0 issues), scripts/check-context.sh, scripts/coverage.sh — all green, every floor met.