script: force lint and test to run in cibuild and docker (closes #115)

script/cibuild and script/docker were plain docker build. On an
unchanged tree the lint stage and the builder stage's make test came
from the layer cache, so the build reported success having linted
nothing and queried no live DNS. Both scripts now pass
--no-cache-filter=lint,builder, so those stages run on every build;
this mirrors script/lint, which already does the same for the lint
stage alone. Dependency downloads inside the disabled stages re-run,
which the issue accepts. No pins, .golangci.yml, or test behaviour
changed. README and TODO.md updated to match.

Model: opus-4-8 (implementation); opus-5-5 (rebase)

README.md

@@ -467,7 +467,10 @@ them. We provide:
 - `script/check` — run test, lint, and fmt-check
 - `script/docker` — build the Docker image tagged via
   `script/projectname`
-- `script/cibuild` — CI entrypoint: plain `docker build .`
+- `script/cibuild` — CI entrypoint: `docker build` with
+  `--no-cache-filter=lint,builder`, forcing the lint and test stages to
+  run on every invocation, because a cached build lints nothing and
+  queries no DNS
 - `script/precommit` — run by the git pre-commit hook; `go mod tidy`
   guard, then `script/check`
 - `script/install-precommit` — install the git pre-commit hook