Lint and test as phases of the Dockerfile (closes #38)

Lint and test are now phases of the one Dockerfile, as the current repo policy requires: a lint phase on the pinned golangci-lint image and a test phase on the pinned Go image, and the build stage depends on both, so a plain docker build . fails when either fails. Dockerfile.lint is gone. REPO_POLICIES.md and script/lint, test, docker and cibuild are byte-identical to the current sneak/prompts copies, so every docker build in script/ is uncached and tagged. make test now needs Docker on the host; formatting is checked on the host only.

Judgement calls: the test phase installs gcc and musl-dev unpinned for -race; no -count=1, since a build stage holds no earlier result.

Model: opus-5-5

Dockerfile

@@ -1,10 +1,48 @@
-# The formatting check, the tests and the build. Linting is not here:
-# it runs in its own pinned image, see Dockerfile.lint and script/lint,
-# which script/cibuild runs before this file.
+# The lint phase, the test phase and the build. script/lint and
+# script/test each build one phase alone; a plain `docker build .` builds
+# both, because the build stage copies a file from each. Formatting is
+# checked on the host by script/fmt-check, not here.
 
+# Lint phase
+# golangci/golangci-lint:v2.12.2, 2026-09-07
+FROM golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN golangci-lint run --config .golangci.yml ./...
+
+# Test phase
+# golang:1.26-alpine, 2026-09-07
+FROM golang@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628 AS test
+
+# -race needs cgo, and cgo needs a C toolchain.
+RUN apk add --no-cache gcc musl-dev
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN go test -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -timeout 90s -race -v ./...; exit 1; }
+
+# Build stage. Nothing is wanted from either phase above; the copies
+# are what make BuildKit build them first, so this stage cannot run
+# unless lint and test passed.
 # golang:1.26-alpine, 2026-09-07
 FROM golang@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628 AS builder
 
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null
+
 RUN apk add --no-cache make git
 
 WORKDIR /src
@@ -14,9 +52,6 @@ RUN go mod download
 
 COPY . .
 
-RUN make fmt-check
-RUN make test
-
 # The version stamped into the binary: the VERSION build argument when one
 # is given, otherwise `git describe --tags --always` of the .git in the
 # build context. A context that carries .git and still yields no version