chore: gofmt the tree, clear staticcheck, add a CI gofmt gate

Nine files had drifted from gofmt and nothing checked; nine staticcheck
findings were live (three dead symbols, capitalization, a redundant
Sprintf, two literal-to-conversion sites, a nil test context). Fix all
of them and make CI fail on unformatted Go so this cannot re-drift.

internal/platform/workloads.go

@@ -47,11 +47,11 @@ const (
 	// and the service token is a credential, so writing either into a checked-in
 	// manifest is a hard red line. The deployment provisions both Secrets
 	// out-of-band before applying these workloads.
-	configSecretName       = "felis-config"
-	configSecretKey        = "felis.toml"
-	configMountPath        = "/etc/felis"
-	configFilePath         = "/etc/felis/felis.toml"
-	felisBinaryPath        = "/usr/local/bin/felis"
+	configSecretName = "felis-config"
+	configSecretKey  = "felis.toml"
+	configMountPath  = "/etc/felis"
+	configFilePath   = "/etc/felis/felis.toml"
+	felisBinaryPath  = "/usr/local/bin/felis"
 	// Single-sourced with the operator, which injects the same Secret into the
 	// login system server's pod (see internal/naming).
 	serviceTokenSecretName = naming.ServiceTokenSecretName