script: force lint and test to run in cibuild and docker (closes #115)

script/cibuild and script/docker were plain docker build. On an
unchanged tree the lint stage and the builder stage, which runs make
test, came from the layer cache, so the build passed without linting
or querying live DNS. Both scripts now pass
--no-cache-filter=lint,builder so those stages run on every build, as
script/lint already does for its own lint stage. Dependency downloads
inside those stages re-run each build. Each of the two stages in the
Dockerfile now notes that the scripts name it. README and TODO.md
updated to match.

Model: opus-4-8 (implementation); opus-5-5 (rework)

TODO.md

@@ -23,6 +23,9 @@ Rationale, Design, TODO, License, Author) if any are still missing.
 
 # Completed Steps
 
+- 2026-09-28: `script/cibuild` and `script/docker` now pass
+  `--no-cache-filter=lint,builder` so lint and tests run every build (closes
+  #115).
 - 2026-09-28: the server timeout test now drives `Run` and checks the
   `http.Server` it serves carries the timeouts; corrected the `ReadTimeout`
   note in that test (closes #120).