docs: correct stale script headers and record the config-verify cost (closes #137)

script/bootstrap credited the goimports pin to script/fmt-check, which
runs gofmt only; the header now credits script/fmt. script/cibuild
still described the Dockerfile as running make check, which stopped
being true once linting moved to its own stage. The docker-missing
warning in script/bootstrap is one sentence instead of three fragments
each carrying the bootstrap: prefix. Dockerfile.lint now states the
residual risk of skipping golangci-lint config verify: unknown
top-level keys in .golangci.yml are ignored silently, so a mistyped key
lints clean and applies nothing.

Comment and message text only; no behaviour changes.

script/bootstrap

@@ -4,7 +4,8 @@
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes nothing is present.
 # goimports is installed via `go install` at a pinned commit (never
-# "latest") because script/fmt and script/fmt-check run it on the host.
+# "latest") because script/fmt runs it on the host; script/fmt-check
+# does not (it runs gofmt only).
 # The linter is NOT installed here: golangci-lint runs via docker only
 # (script/lint), pinned by image digest, so its only prerequisite is a
 # working docker.
@@ -77,9 +78,8 @@ main() {
     # Linting runs via docker only (script/lint). Warn, don't fail:
     # everything except `make lint` works without it.
     if missing docker; then
-        echo "bootstrap: WARNING: docker not found; make lint and" >&2
-        echo "bootstrap: make docker require it. Install docker to" >&2
-        echo "bootstrap: run the linter." >&2
+        echo "bootstrap: WARNING: docker not found; install it to" \
+            "run make lint and make docker." >&2
     fi
 
     go mod download