Lint and test as phases of the Dockerfile (closes #38)

Linting and testing are now the lint and test phases of the one
Dockerfile, and the build stage copies a file from each, so a plain
docker build . cannot pass while either fails. Dockerfile.lint is gone.
REPO_POLICIES.md, script/lint, script/test, script/docker and
script/cibuild are the current copies from the next branch of
sneak/prompts: every docker build there is uncached and tagged,
script/test builds the test phase instead of running go vet and go test
on the host, and script/cibuild bootstraps, runs script/check, then
builds the image with the version from the host. The test phase
installs gcc and musl-dev because -race needs cgo. The version stamping
is unchanged. The issue's line leaves the README TODO list.

Model: opus-5-5

script/bootstrap

@@ -3,9 +3,9 @@
 # repo. Idempotent: every install is guarded by a check, so tools that
 # are already there are left alone. Base tooling comes from nix, apt,
 # brew, or apk, detected in that order, and nothing is assumed to be
-# present. The linter is not installed here: it only ever runs inside
-# the image built from Dockerfile.lint, so Docker is what is needed for
-# it, and that is checked for rather than installed.
+# present. The linter is not installed here: linting and testing run
+# only as phases of the Dockerfile, so Docker is what is needed for
+# them, and that is checked for rather than installed.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -60,7 +60,7 @@ main() {
     go mod download
 
     if missing docker; then
-        echo "bootstrap: docker is not installed; make lint needs it" >&2
+        echo "bootstrap: docker is not installed; make lint and make test need it" >&2
     fi
 
     echo "bootstrap complete"