fix(go): repair the broken build and format the Go tree (#28)

* fix(go): repair build broken by watchdog merges

Three faults that CI could not report while Actions was failing before
step 1:

- core/nano/runner.go: the CursorStore interface mixed named and unnamed
  parameters, which Go rejects outright. Both implementations already
  used (ctx context.Context, programDigest, nodeID string); name ctx so
  the interface matches them.
- cmd/antiflock-agent/main.go: stdlib runtime and agent/runtime were both
  bound to the identifier runtime, so all ten agent-runtime calls
  resolved to the wrong package. Alias the agent package as
  agentruntime, matching the existing agentenrollment convention, and
  leave runtime.GOOS on the standard library.
- 21 error strings began with a capitalized Core/Headscale/Nano (ST1005).
  Staticcheck reported only 12 because it skips packages that fail to
  typecheck; the rest would surface once the build was repaired. No test
  asserts on these strings and sentinels are compared with errors.Is.

* chore: temporary gofmt-diff workflow (removed before merge)

* chore: trigger gofmt-diff on this branch

* style: apply gofmt to the Go tree

The watchdog and BYOK merges landed unformatted while CI could not run:
struct fields unaligned, statements crammed onto single lines with
semicolons, and one out-of-order import group. This is mechanical
`gofmt -w` output over the 34 files it flagged - no behavior change.

Also removes the temporary _gofmt-diff workflow used to obtain the exact
patch on a workstation without a Go toolchain.

* fix(nano,tests): idempotent watchdog re-admission and three unrunnable tests

With the build repaired, the Go tests ran for the first time since the
watchdog merges and four failed.

One was a real defect. nano_watchdog_programs carries two uniqueness
guarantees - operation_id, and (node_id, program_digest) - but only the
first was mapped to a sentinel, and SQLite checks the composite index
first. Re-admitting an identical program therefore returned a raw
constraint error and the documented idempotent-replay path was
unreachable. Map the composite violation to storage.ErrProgramConflict
and have Registry.Admit return the existing record when the operation,
binding, and source all match; a digest that is already admitted under a
different operation stays an error so the audit trail keeps binding one
operation to one program.

The other three were tests that could never have passed:

- agent/ingest: httptest's client carries no timeout, which the bounded
  agent-timeout guard correctly rejects; give the test client a timeout
  rather than weakening the guard.
- agent/runtime: the test reopens the queue to model a restart but never
  released the first handle, so the process-level lock correctly refused
  the second open; close before reopening.
- core/server: the mTLS request sent no Content-Type, so it stopped at
  415 before reaching the 400 the test asserts; set the header so the
  test still proves certificate-only authentication is accepted.

* ci: give gitleaks the token it needs to scan pull requests

gitleaks-action v3 requires GITHUB_TOKEN to enumerate a pull request's
commits and fails before scanning without it, so secret scanning has
never actually run on a pull request. Supply the automatic token and the
pull-requests: read permission it reads.

* fix(scripts): run tool containers as the invoking user

The acceptance gate regenerates the protobuf Go API through the pinned
Buf container. The container ran as root, so the generated tree under
.cache/ came back root-owned and the host cleanup failed with EACCES,
taking the schemas gate down with it. The CI protobuf job never saw this
because it installs Buf natively and skips the container entirely, but
any Linux operator running npm run verify without Buf on PATH hits it.

Pass --user with the invoking uid/gid on POSIX hosts. Windows and macOS
Docker Desktop map ownership themselves and expose no process.getuid, so
they keep the previous behavior. This covers the Go, Buf, Gradle, and
gofmt container fallbacks.

* fix(scripts): give de-privileged tool containers a writable HOME

Running the containers as the invoking user fixed the root-owned
generated tree, but the mapped uid has no /etc/passwd entry, so HOME was
unset and Buf resolved its cache to /.cache and failed with
'mkdir /.cache: permission denied'. Point HOME and XDG_CACHE_HOME at
/tmp, which is writable and discarded with the --rm container.

The Gradle image is exempted: it owns a named cache volume that Docker
initializes with the image's own uid, which the host uid need not match,
so de-privileging it would trade one permission failure for another.

* chore: drop an accidentally committed debug log