contrib/scripts: fix check-fmt.sh aborting with exit 123 on Go 1.26+

gofmt was changed in Go 1.26 to exit non-zero when -d finds a diff
(https://cs.opensource.google/go/go/+/d945600d060e7a0b7c5e72ac606a017d105a17f3).
Combined with set -e and set -o pipefail at the top of the script, that
exit propagates through xargs as code 123 and kills the script before the
"Unformatted Go source code:" branch can run.

The contributor sees a cryptic "Error 123" with no diff instead of the
helpful diff output the script was designed to produce. Now that go.mod
requires Go >= 1.26, every contributor running 'make precheck' on a
freshly-bumped toolchain hits this.

Capture the gofmt output and exit code explicitly with set +e/-e around
the pipeline, then dispatch:

  - non-empty diff -> exit 1 with the helpful message (existing behavior).
  - empty diff but non-zero gofmt exit -> surface the real gofmt error
    on stderr and propagate the exit code.
  - clean tree -> exit 0.

Verified manually with Go 1.26.2 by introducing a formatting issue in a
sample file and running the script before and after the fix:

  Before: exit 123, no output.
  After:  exit 1, prints "Unformatted Go source code:" + the diff.

A clean tree still exits 0.

Fixes: cilium#45677
Signed-off-by: Azeez Syed <syedazeez337@gmail.com>

Author: syedazeez337

contrib/scripts/check-fmt.sh

@@ -5,18 +5,32 @@ set -o pipefail
 
 _goroot=$(${GO:-go} env GOROOT)
 
+# Go 1.26 changed `gofmt -d` to exit non-zero when a diff is found
+# (https://cs.opensource.google/go/go/+/d945600d060e7a0b7c5e72ac606a017d105a17f3),
+# which combined with `set -e -o pipefail` above kills this script before the
+# user-friendly "Unformatted Go source code" branch below can run. Capture the
+# output and exit code explicitly so we can dispatch on whether a diff was found
+# (exit 1 with helpful message) versus a real gofmt failure (propagate the code).
+set +e
 diff="$(find . ! \( -path './contrib' -prune \) \
         ! \( -regex '.*/vendor/.*' -prune \) \
         ! \( -path './_build' -prune \) \
         ! \( -path './.git' -prune \) \
         ! \( -path '*.validate.go' -prune \) \
         -type f -name '*.go' | grep -Ev "(pkg/k8s/apis/cilium.io/v2/client/bindata.go)" | \
         xargs $_goroot/bin/gofmt -d -l -s )"
+gofmt_exit=$?
+set -e
 
 if [ -n "$diff" ]; then
 	echo "Unformatted Go source code:"
 	echo "$diff"
 	exit 1
 fi
 
+if [ "$gofmt_exit" -ne 0 ]; then
+	echo "gofmt exited with $gofmt_exit but produced no diff" >&2
+	exit "$gofmt_exit"
+fi
+
 exit 0