Run lint and tests as phases of the Dockerfile (closes #5)

The Dockerfile gets a lint phase on the pinned golangci-lint v2.12.2
image and a test phase on the Debian Go image. The tests run as an
unprivileged user, because root reads a file with mode 0000 and the
permission test then fails. The build stage copies a file from each
phase, so no build finishes unless both pass, and it no longer runs
make check. script/lint and script/test each build their phase,
uncached and tagged; script/cibuild bootstraps, runs script/check, then
builds the image. script/bootstrap no longer installs golangci-lint.
README.md and TODO.md describe the new setup.

Model: opus-5-5

README.md

@@ -95,7 +95,9 @@ Future improvements under consideration:
 
 * Author & maintainer: **sneak** – <sneak@sneak.berlin>
 * Issues / PRs: <https://git.eeqj.de/sneak/attrsum/>
-* Code must pass `go vet`, `go test ./...`, and `go fmt`.
+* Code must pass `make check`, which runs the tests and golangci-lint as
+  phases of the `Dockerfile` (Docker is required) and checks formatting
+  with `gofmt`.
 * No CLA; contributions are under WTFPL v2.
 
 ---