chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

Mechanical reformat. The new 'gofmt drift' CI step (added in
ci-pipeline-cleanup Phase 4, commit 0f205a8) surfaced 111 files
with accumulated gofmt drift across cmd/, internal/, and deploy/test/.

Each file's diff is gofmt-standard: whitespace adjustments, intra-
group import sorting (alphabetical by import path within blank-line-
separated groups), and struct-tag column alignment. No semantic
changes — verified via 'git diff --ignore-all-space' which shows only
the line-position deltas from import reordering.

The gate stays in place after this commit. Going forward it catches
gofmt drift at PR time.

cmd/agent/main.go

@@ -34,16 +34,16 @@ import (
 	"github.com/shankar0123/certctl/internal/connector/target/apache"
 	"github.com/shankar0123/certctl/internal/connector/target/caddy"
 	"github.com/shankar0123/certctl/internal/connector/target/envoy"
-	pf "github.com/shankar0123/certctl/internal/connector/target/postfix"
-	sshconn "github.com/shankar0123/certctl/internal/connector/target/ssh"
 	"github.com/shankar0123/certctl/internal/connector/target/f5"
-	jks "github.com/shankar0123/certctl/internal/connector/target/javakeystore"
-	k8s "github.com/shankar0123/certctl/internal/connector/target/k8ssecret"
-	wcs "github.com/shankar0123/certctl/internal/connector/target/wincertstore"
 	"github.com/shankar0123/certctl/internal/connector/target/haproxy"
 	"github.com/shankar0123/certctl/internal/connector/target/iis"
+	jks "github.com/shankar0123/certctl/internal/connector/target/javakeystore"
+	k8s "github.com/shankar0123/certctl/internal/connector/target/k8ssecret"
 	"github.com/shankar0123/certctl/internal/connector/target/nginx"
+	pf "github.com/shankar0123/certctl/internal/connector/target/postfix"
+	sshconn "github.com/shankar0123/certctl/internal/connector/target/ssh"
 	"github.com/shankar0123/certctl/internal/connector/target/traefik"
+	wcs "github.com/shankar0123/certctl/internal/connector/target/wincertstore"
 )
 
 // AgentConfig represents the agent-side configuration.

internal/api/handler/agent_groups.go

@@ -1,10 +1,10 @@
 package handler
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
-	"errors"
 	"context"
 	"encoding/json"
+	"errors"
+	"github.com/shankar0123/certctl/internal/repository"
 	"net/http"
 	"strconv"
 	"strings"

internal/api/handler/agents.go

@@ -1,10 +1,10 @@
 package handler
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
 	"context"
 	"encoding/json"
 	"errors"
+	"github.com/shankar0123/certctl/internal/repository"
 	"log/slog"
 	"net/http"
 	"strconv"

internal/api/handler/audit_handler_test.go

@@ -9,8 +9,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/shankar0123/certctl/internal/domain"
 	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
 )
 
 // mockAuditService implements AuditService for testing.

internal/api/handler/export.go

@@ -1,11 +1,11 @@
 package handler
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
-	"errors"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"github.com/shankar0123/certctl/internal/repository"
 	"log/slog"
 	"net/http"
 	"strings"

internal/api/handler/issuers.go

@@ -1,10 +1,10 @@
 package handler
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
-	"errors"
 	"context"
 	"encoding/json"
+	"errors"
+	"github.com/shankar0123/certctl/internal/repository"
 	"log/slog"
 	"net/http"
 	"strconv"

internal/api/handler/jobs.go

@@ -1,10 +1,10 @@
 package handler
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
 	"context"
 	"encoding/json"
 	"errors"
+	"github.com/shankar0123/certctl/internal/repository"
 	"io"
 	"net/http"
 	"strconv"

internal/api/handler/notifications.go

@@ -1,9 +1,9 @@
 package handler
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
-	"errors"
 	"context"
+	"errors"
+	"github.com/shankar0123/certctl/internal/repository"
 	"net/http"
 	"strconv"
 	"strings"

internal/api/handler/owners.go

@@ -1,10 +1,10 @@
 package handler
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
-	"errors"
 	"context"
 	"encoding/json"
+	"errors"
+	"github.com/shankar0123/certctl/internal/repository"
 	"net/http"
 	"strconv"
 	"strings"

internal/api/handler/profiles.go

@@ -1,10 +1,10 @@
 package handler
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
-	"errors"
 	"context"
 	"encoding/json"
+	"errors"
+	"github.com/shankar0123/certctl/internal/repository"
 	"net/http"
 	"strconv"
 	"strings"

internal/api/handler/renewal_policy.go

@@ -1,10 +1,10 @@
 package handler
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
 	"context"
 	"encoding/json"
 	"errors"
+	"github.com/shankar0123/certctl/internal/repository"
 	"net/http"
 	"strconv"
 	"strings"

internal/config/config_test.go

@@ -1091,6 +1091,7 @@ func TestGetEnvBool(t *testing.T) {
 		})
 	}
 }
+
 // I-003: Job timeout reaper configuration tests
 func TestConfig_Scheduler_JobTimeoutDefaults(t *testing.T) {
 	clearCertctlEnv(t)

internal/connector/discovery/awssm/awssm_test.go

@@ -369,4 +369,3 @@ func TestSource_Discover_AgentIDAndSourcePath(t *testing.T) {
 		t.Errorf("expected source path 'aws-sm://eu-west-1/my-secret', got %s", report.Certificates[0].SourcePath)
 	}
 }
-

internal/connector/issuer/acme/profile.go

@@ -249,4 +249,3 @@ func signJWS(key *ecdsa.PrivateKey, kid, nonce, targetURL string, payload []byte
 
 	return json.Marshal(jws)
 }
-

internal/connector/issuer/stepca/stepca_test.go

@@ -1770,4 +1770,3 @@ func TestIntegration_FullLifecycle(t *testing.T) {
 		t.Errorf("Expected status 'completed', got '%s'", status.Status)
 	}
 }
-

internal/connector/target/k8ssecret/k8ssecret_test.go

@@ -644,4 +644,3 @@ func contains(s, substr string) bool {
 	}
 	return false
 }
-

internal/connector/target/wincertstore/wincertstore.go

@@ -310,4 +310,3 @@ func (c *Connector) ValidateDeployment(ctx context.Context, request target.Valid
 
 // Ensure Connector implements target.Connector.
 var _ target.Connector = (*Connector)(nil)
-

internal/repository/postgres/agent.go

@@ -1,10 +1,10 @@
 package postgres
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
 	"context"
 	"database/sql"
 	"fmt"
+	"github.com/shankar0123/certctl/internal/repository"
 	"time"
 
 	"github.com/google/uuid"

internal/repository/postgres/agent_group.go

@@ -1,10 +1,10 @@
 package postgres
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
 	"context"
 	"database/sql"
 	"fmt"
+	"github.com/shankar0123/certctl/internal/repository"
 	"time"
 
 	"github.com/shankar0123/certctl/internal/domain"

internal/repository/postgres/issuer.go

@@ -1,10 +1,10 @@
 package postgres
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
 	"context"
 	"database/sql"
 	"fmt"
+	"github.com/shankar0123/certctl/internal/repository"
 
 	"github.com/google/uuid"
 	"github.com/shankar0123/certctl/internal/domain"

internal/repository/postgres/job.go

@@ -1,10 +1,10 @@
 package postgres
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
 	"context"
 	"database/sql"
 	"fmt"
+	"github.com/shankar0123/certctl/internal/repository"
 	"time"
 
 	"github.com/google/uuid"

internal/repository/postgres/network_scan.go

@@ -1,10 +1,10 @@
 package postgres
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
 	"context"
 	"database/sql"
 	"fmt"
+	"github.com/shankar0123/certctl/internal/repository"
 	"time"
 
 	"github.com/lib/pq"

internal/repository/postgres/owner.go

@@ -1,10 +1,10 @@
 package postgres
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
 	"context"
 	"database/sql"
 	"fmt"
+	"github.com/shankar0123/certctl/internal/repository"
 
 	"github.com/google/uuid"
 	"github.com/shankar0123/certctl/internal/domain"

internal/repository/postgres/revocation.go

@@ -1,10 +1,10 @@
 package postgres
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
 	"context"
 	"database/sql"
 	"fmt"
+	"github.com/shankar0123/certctl/internal/repository"
 
 	"github.com/shankar0123/certctl/internal/domain"
 )

internal/repository/postgres/target.go

@@ -1,10 +1,10 @@
 package postgres
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
 	"context"
 	"database/sql"
 	"fmt"
+	"github.com/shankar0123/certctl/internal/repository"
 
 	"github.com/google/uuid"
 	"github.com/shankar0123/certctl/internal/domain"

internal/repository/postgres/team.go

@@ -1,10 +1,10 @@
 package postgres
 
 import (
-	"github.com/shankar0123/certctl/internal/repository"
 	"context"
 	"database/sql"
 	"fmt"
+	"github.com/shankar0123/certctl/internal/repository"
 
 	"github.com/google/uuid"
 	"github.com/shankar0123/certctl/internal/domain"

internal/scheduler/scheduler_test.go

@@ -138,7 +138,6 @@ func (m *mockJobService) RetryFailedJobs(ctx context.Context, maxRetries int) er
 	return nil
 }
 
-
 // ReapTimedOutJobs is the scheduler-driven counterpart to ProcessPendingJobs that
 // covers coverage gap I-003: JobService.ReapTimedOutJobs (via JobReaperService interface)
 // had no runtime caller prior to the jobTimeoutLoop being wired.

internal/service/agent_test.go

@@ -10,7 +10,6 @@ import (
 	"github.com/shankar0123/certctl/internal/domain"
 )
 
-
 func TestRegisterAgent(t *testing.T) {
 	ctx := context.Background()
 	agentRepo := &mockAgentRepo{

internal/service/job.go

@@ -1,12 +1,12 @@
 package service
 
 import (
-	"time"
 	"context"
 	"errors"
 	"fmt"
 	"log/slog"
 	"strings"
+	"time"
 
 	"github.com/shankar0123/certctl/internal/domain"
 	"github.com/shankar0123/certctl/internal/repository"

internal/service/renewal_test.go

@@ -1313,7 +1313,6 @@ func TestFailJob_SetsFailedStatus(t *testing.T) {
 	}
 }
 
-
 // --- CreateDeploymentJobs Tests ---
 
 func TestCreateDeploymentJobs_PartialFailure(t *testing.T) {
@@ -1383,5 +1382,4 @@ func TestCreateDeploymentJobs_PartialFailure(t *testing.T) {
 	}
 }
 
-
 // stringPtr is defined in notification_test.go

internal/validation/command_test.go

@@ -525,4 +525,3 @@ func TestSanitizeForShell(t *testing.T) {
 		})
 	}
 }
-