Split Dockerfile: pre-built golangci-lint stage for faster CI (#26)

Closes [#22](#22)

## Changes

### Makefile
- Added `fmt-check` target: checks gofmt formatting without modifying files
- Added `hooks` target: installs pre-commit git hook
- Updated `check` target: now runs `fmt-check lint test`
- Removed redundant gofmt check from `lint` target (now in `fmt-check`)
- Added `.PHONY` declarations for all phony targets
- Updated `tools` target to use `go install`

### Dockerfile
- **Lint stage**: Uses pre-built `golangci/golangci-lint:v1.64.8` (sha256-pinned)
  - Runs `make fmt-check` and `make lint` for fast feedback
- **Build stage**: Uses `golang:1.24-bookworm` (sha256-pinned, matches go.mod 1.24.0)
  - `COPY --from=lint` forces BuildKit to actually run the lint stage
  - Runs `make test` then `make build`
- **Runtime stage**: Uses `debian:bookworm-slim` (sha256-pinned)
- All base images updated from ancient/unpinned versions to current sha256-pinned images
- Removed vendoring/source tarball per CLAUDE.md policy

### CI
- Added `.gitea/workflows/check.yml`: runs `docker build .` on push to main and PRs

## Image Versions
| Stage | Image | Digest |
|-------|-------|--------|
| lint | golangci/golangci-lint:v1.64.8 | sha256:2987913e...5cb8 |
| build | golang:1.24-bookworm | sha256:1a6d4452...77ac |
| runtime | debian:bookworm-slim | sha256:74d56e39...4421 |

## Verification
`docker build .` passes locally — all stages (lint, test, build) execute correctly.

<!-- session: agent:sdlc-manager:subagent:bcf4d5ff-f487-4dcb-aa85-1c0e039bbb3b -->

Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de>
Reviewed-on: #26
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

Makefile

@@ -11,22 +11,30 @@ default: clean debug
 commit: fmt lint
 	git commit -a
 
-# get golangci-lint with:
-# go get github.com/golangci/golangci-lint/cmd/golangci-lint@v1.31.0
-# get gofumports with:
-# go get mvdan.cc/gofumpt/gofumports
+# get gofumpt with:
+# go install mvdan.cc/gofumpt@latest
 fmt:
 	gofumpt -l -w .
 	golangci-lint run --fix
 
+fmt-check:
+	@test -z "$$(gofmt -l .)" || { echo "gofmt found unformatted files:"; gofmt -l .; exit 1; }
+
 lint:
 	golangci-lint run
-	sh -c 'test -z "$$(gofmt -l .)"'
 
 test:
 	go test ./...
 
-check: lint test
+check: fmt-check lint test
+
+build: ./$(FN)d
+
+hooks:
+	@mkdir -p .git/hooks
+	@printf '#!/bin/sh\nmake fmt-check lint\n' > .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit
+	@echo "Pre-commit hook installed."
 
 debug: ./$(FN)d
 	DEBUG=1 GOTRACEBACK=all ./$(FN)d
@@ -48,5 +56,6 @@ docker:
 		go build -o ../../$(FN)d $(GOFLAGS) .
 
 tools:
-	go get -v github.com/golangci/golangci-lint/cmd/golangci-lint@v1.31.0
-	go get -v mvdan.cc/gofumpt/gofumports
+	go install mvdan.cc/gofumpt@latest
+
+.PHONY: default commit fmt fmt-check lint test check build hooks debug debugger run clean docker tools