Lint and test as phases of the Dockerfile (closes #38)

Lint and test are now phases of the one Dockerfile, as the current repo policy requires: a lint phase on the pinned golangci-lint image and a test phase on the pinned Go image, and the build stage depends on both, so a plain docker build . fails when either fails. Dockerfile.lint is gone. REPO_POLICIES.md and script/lint, test, docker and cibuild are byte-identical to the current sneak/prompts copies, so every docker build in script/ is uncached and tagged. make test now needs Docker on the host; formatting is checked on the host only.

Judgement calls: the test phase installs gcc and musl-dev unpinned for -race; no -count=1, since a build stage holds no earlier result.

Model: opus-5-5

README.md

@@ -290,18 +290,22 @@ standard: most Makefile targets are thin shims over an executable in
   git pre-commit hook.
 - `script/projectname` prints the project name; other scripts call it so they
   stay identical across repos.
-- `script/test` runs `go vet` and then the test suite, rerunning verbosely if a
-  test fails.
-- `script/lint` runs the linter inside the image built from `Dockerfile.lint`
-  (which pins the linter by hash), so a complaint fails the build and leaves no
-  container behind.
+- `script/test` builds the `test` phase of the `Dockerfile` alone, uncached: the
+  test suite runs with the race detector inside the build, rerunning verbosely
+  if a test fails.
+- `script/lint` builds the `lint` phase of the `Dockerfile` alone, uncached: the
+  linter, pinned by hash, runs inside the build, so a complaint fails it and
+  leaves no container behind.
 - `script/fmt` formats the Go source in place.
 - `script/fmt-check` checks that formatting without writing, failing if anything
   is unformatted.
 - `script/check` runs `test`, `lint` and `fmt-check` and changes no files.
-- `script/docker` builds the Docker image tagged with the project name.
-- `script/cibuild` is the CI build the Gitea workflow calls: it runs the linter,
-  then `docker build`.
+- `script/docker` builds the Docker image, uncached, tagged with the project
+  name and stamped with the version `git describe` gives on the host. The image
+  cannot be built unless the `lint` and `test` phases pass, so a plain
+  `docker build .` runs them too.
+- `script/cibuild` is the CI build the Gitea workflow calls: it runs
+  `bootstrap`, then `check`, then builds the image as `script/docker` does.
 - `script/precommit` is what the git pre-commit hook runs: `go mod tidy` and
   `go fmt`, failing if `go.mod` or `go.sum` changed, then `check`.
 - `script/install-precommit` installs the git pre-commit hook that runs
@@ -311,7 +315,6 @@ standard: most Makefile targets are thin shims over an executable in
 
 The open issues that stand between the tree and a 1.0 release:
 
-- [#38 Lint and test as phases of the Dockerfile, as the current repo policy requires](https://git.eeqj.de/sneak/keyfunc/issues/38)
 - [#39 make fmt and make fmt-check cover Markdown with prettier](https://git.eeqj.de/sneak/keyfunc/issues/39)
 - [#42 go-bip39 no longer exists upstream: keep it, or copy it into the repo?](https://git.eeqj.de/sneak/keyfunc/issues/42)