Lint and test as phases of the Dockerfile (closes #38)

Linting and testing are now the lint and test phases of the one
Dockerfile, and the build stage copies a file from each, so a plain
docker build . cannot pass while either fails. Dockerfile.lint is gone.
REPO_POLICIES.md, script/lint, script/test, script/docker and
script/cibuild are the current copies from the next branch of
sneak/prompts: every docker build there is uncached and tagged,
script/test builds the test phase instead of running go vet and go test
on the host, and script/cibuild bootstraps, runs script/check, then
builds the image with the version from the host. The test phase
installs gcc and musl-dev because -race needs cgo. The version stamping
is unchanged. The issue's line leaves the README TODO list.

Model: opus-5-5

README.md

@@ -290,18 +290,22 @@ standard: most Makefile targets are thin shims over an executable in
   git pre-commit hook.
 - `script/projectname` prints the project name; other scripts call it so they
   stay identical across repos.
-- `script/test` runs `go vet` and then the test suite, rerunning verbosely if a
-  test fails.
-- `script/lint` runs the linter inside the image built from `Dockerfile.lint`
-  (which pins the linter by hash), so a complaint fails the build and leaves no
-  container behind.
+- `script/test` builds the `test` phase of the `Dockerfile` alone, uncached: the
+  test suite runs with the race detector inside the build, rerunning verbosely
+  if a test fails.
+- `script/lint` builds the `lint` phase of the `Dockerfile` alone, uncached: the
+  linter, pinned by hash, runs inside the build, so a complaint fails it and
+  leaves no container behind.
 - `script/fmt` formats the Go source in place.
 - `script/fmt-check` checks that formatting without writing, failing if anything
   is unformatted.
 - `script/check` runs `test`, `lint` and `fmt-check` and changes no files.
-- `script/docker` builds the Docker image tagged with the project name.
-- `script/cibuild` is the CI build the Gitea workflow calls: it runs the linter,
-  then `docker build`.
+- `script/docker` builds the Docker image, uncached, tagged with the project
+  name and stamped with the version `git describe` gives on the host. The image
+  cannot be built unless the `lint` and `test` phases pass, so a plain
+  `docker build .` runs them too.
+- `script/cibuild` is the CI build the Gitea workflow calls: it runs
+  `bootstrap`, then `check`, then builds the image as `script/docker` does.
 - `script/precommit` is what the git pre-commit hook runs: `go mod tidy` and
   `go fmt`, failing if `go.mod` or `go.sum` changed, then `check`.
 - `script/install-precommit` installs the git pre-commit hook that runs
@@ -311,7 +315,6 @@ standard: most Makefile targets are thin shims over an executable in
 
 The open issues that stand between the tree and a 1.0 release:
 
-- [#38 Lint and test as phases of the Dockerfile, as the current repo policy requires](https://git.eeqj.de/sneak/keyfunc/issues/38)
 - [#39 make fmt and make fmt-check cover Markdown with prettier](https://git.eeqj.de/sneak/keyfunc/issues/39)
 - [#40 The linter config, .gitignore and .dockerignore from the current templates](https://git.eeqj.de/sneak/keyfunc/issues/40)
 - [#42 go-bip39 no longer exists upstream: keep it, or copy it into the repo?](https://git.eeqj.de/sneak/keyfunc/issues/42)