Run lint and tests as phases of the Dockerfile (closes #5)

The Dockerfile gets a lint phase on the pinned golangci-lint v2.12.2
image and a test phase on the Debian Go image. The tests run as an
unprivileged user, because root reads a file with mode 0000 and the
permission test then fails. The build stage copies a file from each
phase, so no build finishes unless both pass, and it no longer runs
make check. script/lint and script/test each build their phase,
uncached and tagged; script/cibuild bootstraps, runs script/check, then
builds the image. script/bootstrap no longer installs golangci-lint.
README.md and TODO.md describe the new setup.

Model: opus-5-5

TODO.md

@@ -17,13 +17,19 @@ have landed since the tag.
 
 # Next Step
 
-Policy scaffold commit: add LICENSE, REPO_POLICIES.md, .editorconfig,
-.golangci.yml, and a comprehensive .gitignore (currently only the
-attrsum binary), and extend the Makefile (only test/build/clean/try
-today) with lint, fmt, fmt-check, check, and hooks targets.
+Re-vendor the canonical files from `sneak/prompts` at `dd4027b`
+(https://git.eeqj.de/sneak/attrsum/issues/13): add `REPO_POLICIES.md`
+and `.editorconfig`, refresh `.gitignore` (only the `attrsum` binary
+today), `.dockerignore`, `.gitea/workflows/check.yml` and
+`.golangci.yml`, and move the lint phase to golangci-lint v2.14.0.
 
 # Completed Steps
 
+* 2026-10-06: lint and test run as phases of the `Dockerfile`, and the
+    build stage depends on both; `script/lint` and `script/test` each
+    build their phase with `--no-cache`; `script/cibuild` bootstraps,
+    runs `script/check`, then builds the image; golangci-lint is no
+    longer installed on the host
 * 2026-10-06: `check --continue` keeps going past a file or directory
     it cannot read: it counts it as failed, prints the error and the
     path on stderr, and checks the rest of the tree
@@ -53,11 +59,12 @@ today) with lint, fmt, fmt-check, check, and hooks targets.
 
 # Future Steps
 
-* Add .gitea/workflows/check.yml
 * Restructure README.md into the standard sections: Description,
-    Getting Started, Rationale, Design, TODO, License, Author (Getting
-    Started, Why?, TODO, License exist; Description, Design, Author are
-    missing)
+    Getting Started, Entrypoints, Rationale, Design, TODO, License,
+    Author (Getting Started, Why?, TODO, License exist; Description,
+    Entrypoints, Design, Author are missing)
+* Add a `LICENSE` file matching the README's WTFPL v2; sneak's to add,
+    not an agent's
 * Tag a patch release to ship the 2026-02-02 correctness fixes
 * Dry-run mode (--dry-run, -n): show what would be done without making
     changes (from README TODO)