build: add ESLint to script/lint and containerize linting (closes #152)

Dockerfile

@@ -1,8 +1,21 @@
 # node:22-slim (22.x LTS), 2026-02-24
-FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
+FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36 AS base
 
 WORKDIR /app
 
+# Marks "already inside the lint container" for script/lint, which otherwise
+# shells out to docker to build the lint stage below. Nothing outside this
+# image sets it.
+ENV AUTISTMASK_LINT_NATIVE=1
+
+# script/test's default 30s bound is the host figure, against a suite that
+# runs in about 8s there. In here the same suite starts on a cold jest cache
+# and shares the runner with the rest of the build, so 30s is marginal rather
+# than a bound — it killed a healthy suite at 30.6s on a cold CI cache. 180s
+# still catches a hang in three minutes and cannot be tripped by a suite that
+# is merely running on contended hardware.
+ENV AUTISTMASK_TEST_TIMEOUT=180
+
 # script/bootstrap installs all prerequisites (make via apt here; node
 # is already in the base image, yarn comes via corepack) and runs
 # yarn install --frozen-lockfile. Dependency manifests are copied first
@@ -13,5 +26,17 @@ RUN script/bootstrap
 
 COPY . .
 
+# Lint stage — fail fast on static analysis and formatting, before the tests
+# and the build. This is also the stage script/lint builds from a host, which
+# is how linting stays on the pinned ESLint rather than the host's.
+FROM base AS lint
+RUN make lint
+
+# Full check and build. The COPY --from is a no-op file copy whose only job is
+# to make BuildKit finish the lint stage before this one starts; without it the
+# stages run in parallel and a lint failure would not fail the build early.
+FROM base AS check
+COPY --from=lint /app/package.json /dev/null
+
 RUN make check
 RUN make build