script: force lint and test to run in cibuild and docker (closes #115)

script/cibuild and script/docker were plain docker build. On an
unchanged tree the lint stage and the builder stage's make test came
from the layer cache, so the build reported success having linted
nothing and queried no live DNS. Both scripts now pass
--no-cache-filter=lint,builder, so those stages run on every build;
this mirrors script/lint, which already does the same for the lint
stage alone. Dependency downloads inside the disabled stages re-run,
which the issue accepts. No pins, .golangci.yml, or test behaviour
changed. README and TODO.md updated to match.

Model: opus-4-8

script/docker

@@ -1,6 +1,11 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname.
+# The tag comes from script/projectname.
+#
+# --no-cache-filter=lint,builder forces the lint stage and the builder
+# stage (make test) to run on every invocation. Without it an unchanged
+# tree serves them from the layer cache, producing an image whose build
+# linted nothing and queried no live DNS.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -8,7 +13,7 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build -t "$("$SCRIPT_DIR/projectname")" .
+    docker build --no-cache-filter=lint,builder -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"