chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

Mechanical reformat. The new 'gofmt drift' CI step (added in
ci-pipeline-cleanup Phase 4, commit 71b2245) surfaced 111 files
with accumulated gofmt drift across cmd/, internal/, and deploy/test/.

Each file's diff is gofmt-standard: whitespace adjustments, intra-
group import sorting (alphabetical by import path within blank-line-
separated groups), and struct-tag column alignment. No semantic
changes — verified via 'git diff --ignore-all-space' which shows only
the line-position deltas from import reordering.

The gate stays in place after this commit. Going forward it catches
gofmt drift at PR time.

internal/service/renewal_test.go

@@ -977,7 +977,7 @@ func TestCheckExpiringCertificates_ARI_ShouldRenewNow(t *testing.T) {
 		ID: "rp-standard", Name: "Standard", RenewalWindowDays: 30,
 		AutoRenew: true, MaxRetries: 3, RetryInterval: 300,
 		AlertThresholdsDays: []int{30, 14, 7, 0},
-		CreatedAt: time.Now(), UpdatedAt: time.Now(),
+		CreatedAt:           time.Now(), UpdatedAt: time.Now(),
 	}
 	policyRepo.AddPolicy(policy)
 
@@ -1050,7 +1050,7 @@ func TestCheckExpiringCertificates_ARI_NotYet(t *testing.T) {
 		ID: "rp-standard", Name: "Standard", RenewalWindowDays: 30,
 		AutoRenew: true, MaxRetries: 3, RetryInterval: 300,
 		AlertThresholdsDays: []int{30, 14, 7, 0},
-		CreatedAt: time.Now(), UpdatedAt: time.Now(),
+		CreatedAt:           time.Now(), UpdatedAt: time.Now(),
 	}
 	policyRepo.AddPolicy(policy)
 
@@ -1110,7 +1110,7 @@ func TestCheckExpiringCertificates_ARI_NilResult_FallsThrough(t *testing.T) {
 		ID: "rp-standard", Name: "Standard", RenewalWindowDays: 30,
 		AutoRenew: true, MaxRetries: 3, RetryInterval: 300,
 		AlertThresholdsDays: []int{30, 14, 7, 0},
-		CreatedAt: time.Now(), UpdatedAt: time.Now(),
+		CreatedAt:           time.Now(), UpdatedAt: time.Now(),
 	}
 	policyRepo.AddPolicy(policy)
 
@@ -1178,7 +1178,7 @@ func TestCheckExpiringCertificates_ARI_Error_FallsThrough(t *testing.T) {
 		ID: "rp-standard", Name: "Standard", RenewalWindowDays: 30,
 		AutoRenew: true, MaxRetries: 3, RetryInterval: 300,
 		AlertThresholdsDays: []int{30, 14, 7, 0},
-		CreatedAt: time.Now(), UpdatedAt: time.Now(),
+		CreatedAt:           time.Now(), UpdatedAt: time.Now(),
 	}
 	policyRepo.AddPolicy(policy)
 
@@ -1313,7 +1313,6 @@ func TestFailJob_SetsFailedStatus(t *testing.T) {
 	}
 }
 
-
 // --- CreateDeploymentJobs Tests ---
 
 func TestCreateDeploymentJobs_PartialFailure(t *testing.T) {
@@ -1331,10 +1330,10 @@ func TestCreateDeploymentJobs_PartialFailure(t *testing.T) {
 
 	// Create certificate
 	cert := &domain.ManagedCertificate{
-		ID:        "mc-partial",
+		ID:         "mc-partial",
 		CommonName: "test.example.com",
-		CreatedAt: time.Now(),
-		UpdatedAt: time.Now(),
+		CreatedAt:  time.Now(),
+		UpdatedAt:  time.Now(),
 	}
 	certRepo.AddCert(cert)
 
@@ -1383,5 +1382,4 @@ func TestCreateDeploymentJobs_PartialFailure(t *testing.T) {
 	}
 }
 
-
 // stringPtr is defined in notification_test.go