check / check (push) Failing after 1s
script/cibuild and script/docker were plain docker build. On an unchanged tree the lint stage and the builder stage's make test came from the layer cache, so the build reported success having linted nothing and queried no live DNS. Both scripts now pass --no-cache-filter=lint,builder, so those stages run on every build; this mirrors script/lint, which already does the same for the lint stage alone. Dependency downloads inside the disabled stages re-run, which the issue accepts. No pins, .golangci.yml, or test behaviour changed. README and TODO.md updated to match. Model: opus-4-8