Tooling: pin tool versions and ensure GOPATH/bin is on PATH after `make install`

[HarryCampion]

Problem

make install (in bootstrap.mk) installs both golangci-lint and goreleaser via go install ...@latest, but GOPATH/bin is not on PATH by default. This causes two classes of failure:

• Pre-commit hooks (dnephin/pre-commit-golang) shell out to whatever is on PATH — silently fail or use a stale system binary.
• The goreleaser-check hook (language: system) shells out directly — fails if the binary isn't on PATH.

Additionally, @latest means there is no version pinning. A fresh make install on a machine with an older Go can produce a golangci-lint binary compiled with an older Go version, which then refuses to lint code targeting a newer version. Example error: "Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.26.1)".

A downstream project has had to add export PATH="$HOME/go/bin:$PATH" to ~/.zshrc as a manual per-developer step — this should not be necessary.

Also, the || true suffix on install lines in bootstrap.mk silently swallows failures; if go install fails the user gets no feedback.

Suggestions

1. bootstrap.mk should emit a loud warning (or error) if $(go env GOPATH)/bin is not on PATH after install. For example:

   post-install:: ## warn if GOPATH/bin is not on PATH
       @if ! echo "$$PATH" | grep -q "$$(go env GOPATH)/bin"; then \
         printf "${YELLOW}[WARN] $(go env GOPATH)/bin is not on PATH — add it to your shell profile${RESET}\n"; \
       fi

2. Pin tool versions in a tools.go file, .tool-versions, or similar manifest so builds are reproducible.
3. Remove (or replace with a real failure) the || true suffix on go install lines so failures are visible.