build: isolate golangci-lint cache and lock per checkout (closes #121)

script/lint used golangci-lint's per-user global state, which breaks
when several checkouts on one host lint concurrently. Two independent
failure modes, two causes:

- Cross-contamination. The analysis cache (GOLANGCI_LINT_CACHE,
  default ~/.cache/golangci-lint) is keyed by content, not by
  checkout, so a hit written by another checkout is replayed with
  that checkout's file paths. A run reports findings for files it
  never linted.

- Lock collision. golangci-lint locks os.TempDir()/golangci-lint.lock
  (pkg/commands/run.go, acquireFileLock), which is NOT in the cache
  directory, with a 5s timeout. Peers that hold it longer make the
  run abort with "parallel golangci-lint is running" - a non-result
  that reads as a lint failure. Isolating the cache does not move it.

Point GOLANGCI_LINT_CACHE and TMPDIR at .lint-cache/ under the
checkout root, using the existing $ROOT idiom. TMPDIR is what makes
the lock per-checkout, so the lock keeps serialising the runs that
actually share a cache instead of being disabled. .lint-cache/ is
git-ignored and Docker-ignored, and the cache persists across runs in
a checkout, so caching is not lost.

Reproduced both modes on the unfixed script across 12 copies of this
tree: 10 of 12 concurrent runs void with the lock error, and 11 of 12
sequential runs reported findings at ../w1/... after an identical
lint-failing file was added to every copy. After the fix, 20-way
concurrency gives 0 void and 0 foreign paths, and each copy reports
only its own relative path.

script/lint

@@ -1,11 +1,40 @@
 #!/bin/sh
 # script/lint: run the linter.
+#
+# golangci-lint keeps two pieces of per-user global state, and both of
+# them break when several checkouts on one host lint concurrently:
+#
+#   1. Its analysis cache (GOLANGCI_LINT_CACHE, default
+#      ~/.cache/golangci-lint). Entries are keyed by content, not by
+#      checkout, so a hit written by another checkout is replayed
+#      verbatim - including that checkout's file paths. The run then
+#      reports findings for files it never linted.
+#
+#   2. Its "one runner at a time" lock, which does NOT live in the
+#      cache directory: golangci-lint locks
+#      $(os.TempDir())/golangci-lint.lock, i.e.
+#      "$TMPDIR"/golangci-lint.lock (pkg/commands/run.go,
+#      acquireFileLock). It waits 5s, then aborts with "parallel
+#      golangci-lint is running" - a non-result that looks like a lint
+#      failure. Setting GOLANGCI_LINT_CACHE alone does not move it.
+#
+# So both are pinned under the checkout root. The cache is never shared,
+# and TMPDIR makes the lock file per-checkout, which keeps the lock
+# doing its actual job (serialising runs that share one cache) at the
+# right scope. .lint-cache/ is git-ignored and Docker-ignored, and
+# caching still works: it persists across runs in this checkout.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
+
+    GOLANGCI_LINT_CACHE="$ROOT/.lint-cache/cache"
+    TMPDIR="$ROOT/.lint-cache/tmp"
+    export GOLANGCI_LINT_CACHE TMPDIR
+    mkdir -p "$GOLANGCI_LINT_CACHE" "$TMPDIR"
+
     golangci-lint run --config .golangci.yml ./...
 }