chore: add gofmt check to pre-commit hook

[Amperstrand]

Extends hooks/pre-commit to also check gofmt -l on staged .go files. Prevents the 16-file gofmt cleanup situation from recurring.

Combined with the existing dependency sync check, the pre-commit hook now catches:

1. Dependency version drift across go.mod files
2. Unformatted Go source files

Install: git config core.hooksPath hooks

Also recommend adding gofmt to CI (test.yml):

  gofmt-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: src/go.mod
      - name: gofmt check
        run: |
          cd src
          if [ -n "$(gofmt -l .)" ]; then
            echo "::error::gofmt found unformatted files"
            gofmt -l .
            exit 1
          fi

[Amperstrand]

Cold-review item (committed ELF binary): resolved. Same blob as #341 (7de4e476, 13MB unstripped) — entered via an unrelated commit under the hook work. Branch rebuilt onto current main with only the gofmt-hook commit (a911079); binary gone, bash -n + functional gofmt-check verification re-run (flags a deliberately unformatted staged file, passes a clean one), CI green. Side effect of the rebuild: no longer stacked on #336's SSID commit — the diff is now the hook alone, so #341→#343 ordering pressure is gone.

[felixfelix-bot]

Cold review — new findings only (1 issue previously raised about ELF binary, resolved, not repeated).

1 major:

Staged deletion of a .go file will crash the hook. git diff --cached --name-only -- '.go' includes files staged for deletion. gofmt -l tries to open the non-existent file, errors out, and because set -e is active, the script exits immediately — blocking the commit. Fix: add --diff-filter=d to exclude deletions:
git diff --cached --name-only --diff-filter=d -- '.go'

1 minor:

• Unquoted command substitution gofmt -l $(...) — filenames with spaces would break. Use xargs or while-read loop

[Amperstrand]

Cold-review response — major + minor fixed in 1eef16d (CI green):

• Major (staged deletion crashes hook): confirmed by inspection, fixed. --diff-filter=d excludes deletions from the gofmt list; files are fed one-per-line via xargs -I{} (spaces-safe, and portable — no mapfile, so it works in OpenWrt's ash too). Functionally verified: staged deletion + unformatted file flags exactly the unformatted file, exit 1, no crash.

[felixfelix-bot]

Re-reviewed at 1eef16d: --diff-filter=d + one-file-per-line feed, verified with staged deletion, ash-portable. Resolved. Good to merge.