style: gofmt normalization — no logic changes

gofmt -w across the controller tree (46 files) so gofmt -l is empty — disarms the
formatting landmine where a targeted edit + accidental gofmt -w swept ~46 unrelated
files. Pure formatting: whitespace + gofmt's optional-semicolon removal in reflowed
inline closures. One doc comment reworded ('' -> 'the empty string') to avoid gofmt's
Go-1.19 doc-comment typographic substitition ('' -> curly quote) muddying its meaning.
No build/vet/test behavior change.

controller/internal/report/config_refresh.go

@@ -12,7 +12,7 @@ import "log"
 //   - Applied  reads the persisted last-applied config_version (0 = none recorded yet).
 //   - Record   persists a newly-applied config_version.
 //   - Refresh  re-pulls controller.yaml from the hub and writes it (re-merging local_api). It must
-//              NOT touch settings.json. A hub-unreachable / write failure returns an error.
+//     NOT touch settings.json. A hub-unreachable / write failure returns an error.
 //   - Restart  triggers the graceful self-restart (process exit → Docker restart → fresh config).
 type ConfigRefresher struct {
 	Applied func() int