chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

Mechanical reformat. The new 'gofmt drift' CI step (added in
ci-pipeline-cleanup Phase 4, commit 71b2245) surfaced 111 files
with accumulated gofmt drift across cmd/, internal/, and deploy/test/.

Each file's diff is gofmt-standard: whitespace adjustments, intra-
group import sorting (alphabetical by import path within blank-line-
separated groups), and struct-tag column alignment. No semantic
changes — verified via 'git diff --ignore-all-space' which shows only
the line-position deltas from import reordering.

The gate stays in place after this commit. Going forward it catches
gofmt drift at PR time.

internal/scheduler/scheduler_test.go

@@ -11,14 +11,14 @@ import (
 
 // mockRenewalService is a mock implementation for testing.
 type mockRenewalService struct {
-	mu                 sync.Mutex
-	callCount          int
-	callTimes          []time.Time
-	expireCallCount    int
-	expireCallTimes    []time.Time
-	slowDelay          time.Duration
-	shouldError        bool
-	blockCh            chan struct{} // if non-nil, blocks until closed (ignores context)
+	mu              sync.Mutex
+	callCount       int
+	callTimes       []time.Time
+	expireCallCount int
+	expireCallTimes []time.Time
+	slowDelay       time.Duration
+	shouldError     bool
+	blockCh         chan struct{} // if non-nil, blocks until closed (ignores context)
 }
 
 func (m *mockRenewalService) CheckExpiringCertificates(ctx context.Context) error {
@@ -138,7 +138,6 @@ func (m *mockJobService) RetryFailedJobs(ctx context.Context, maxRetries int) er
 	return nil
 }
 
-
 // ReapTimedOutJobs is the scheduler-driven counterpart to ProcessPendingJobs that
 // covers coverage gap I-003: JobService.ReapTimedOutJobs (via JobReaperService interface)
 // had no runtime caller prior to the jobTimeoutLoop being wired.