Run the lint inside Docker via Dockerfile.lint (closes #38)

Add a root Dockerfile.lint that runs `hugo --minify --printPathWarnings`
as a build step, so a successful build IS a clean lint, and reduce
script/lint to building that file. There is no host lint path and
deliberately no "am I already inside a container?" branch, which would
be a host lint path in disguise.

The containerisation boundary is lint only, per the owner ruling on the
issue: formatting is not a lint, so script/fmt and script/fmt-check stay
on the host, unchanged in version, scope and flags. That also removes
the forced duplication of prettier's settings between a script and a
Dockerfile, and with it the keep-in-sync notes that duplication needed.

Dockerfile.lint has exactly one stage on purpose. A whole-file
`docker build -f Dockerfile.lint .` builds only the file's last stage,
and sibling stages off a shared base carry no ordering edge, so a second
stage beside the lint would be silently skipped by exactly the
invocation the canonical org-wide script/lint uses -- a green that
linted nothing, which the per-stage CHECK_EPOCH guard cannot catch
because the stage that did run satisfies it. With one stage there is
nothing to skip and script/lint needs no --target. A comment in the file
says that any second check added here must be chained or carry an
explicit ordering edge, never left as a sibling.

Its first four instructions are byte-identical to the main Dockerfile's
and in the same order, so the expensive `RUN script/bootstrap` layer
that compiles the pinned Hugo from source is shared between the two
images rather than paid twice.

Resolve the recursion by direction, not detection. `make check` calls
script/lint, and script/lint is now a `docker build`, so `RUN make
check` in an image would attempt a docker build inside a build step
where there is no daemon. The main Dockerfile therefore runs the
individual non-lint checks -- script/test and script/fmt-check, as
separate RUN lines under the CHECK_EPOCH guard -- matching the canonical
shape, and only the lint is absent from it. script/cibuild runs
script/lint first, for fail-fast feedback: on a runner with no cached
bootstrap layer a lint failure should not wait behind a Hugo build from
source. CI coverage is therefore unchanged, and it runs the same scripts
a developer runs.

Caching is waived for the lint in the shape this repo already settled:
ARG CHECK_EPOCH with no default, guarded with
`[ -n "$CHECK_EPOCH" ] || exit 1`, and the value expanded into the
linted command as well as the guard, so invalidation never rests on
BuildKit's treatment of an unreferenced ARG. Every image-building
entrypoint generates and passes it -- script/cibuild, script/docker,
script/lint -- each as a whole assignment rather than inline, for the
`set -e` reason script/cibuild documents.

script/lint builds with `--output type=cacheonly`: the build is run for
its exit status, not for an image, and because the lint layer is
cache-busted on every invocation an exporting build leaves one dangling
image per lint run. On a host shared with other work that accumulates.
The build cache is unaffected, so script/bootstrap still hits, and
failures still propagate.

Two divergences from REPO_POLICIES.md, stated rather than buried:

  - REPO_POLICIES.md:92, "all Dockerfiles must run `make check`". That
    rule and "every lint run happens in Docker" cannot both hold once
    `make check` contains the lint.
  - REPO_POLICIES.md:102-168, which requires a separate lint stage whose
    result the build stage depends on through
    `COPY --from=lint /src/go.sum /dev/null`, on the stated grounds that
    without the edge "the build stage would not wait for lint to finish
    and a lint failure might not fail the overall build". No such edge
    exists here: the lint is its own file and its own build, sequenced
    by script/cibuild rather than by BuildKit. Both sections are
    superseded upstream by 12e8db8 in sneak/prompts, which deletes the
    Go multistage lint stage and its ordering trick for the same reason
    -- that stage ran `make lint`, which is now a docker build.

Verified: two consecutive script/lint runs on an unchanged tree both
executed hugo for real, distinct epochs echoed, script/bootstrap CACHED,
second run 0.85s; a whole-file `docker build -f Dockerfile.lint .` with
the argument and no --target ran the lint for real; a bare build with no
argument failed closed on the guard; a planted template error failed the
lint with hugo's own render error and made script/cibuild exit non-zero
in 0.6s with the main image build never starting; a planted over-long
line failed the host script/fmt-check; both reverted and re-run clean;
`make check`, script/docker and script/cibuild all green with every
check layer observed executing rather than served from cache, and the
bootstrap layer CACHED in both images. The deploy path is byte-identical
to main: .gitea/, script/bootstrap, script/test and .dockerignore are
untouched.

Dockerfile.lint

@@ -0,0 +1,61 @@
+# Lint-only image. `script/lint` builds this file and nothing else: the
+# lint runs as a build step, so a successful build IS a clean lint.
+#
+# One stage, deliberately. A whole-file `docker build -f Dockerfile.lint .`
+# builds only the file's LAST stage, and sibling stages off a shared base
+# have no ordering edge between them, so a second stage sitting beside
+# this one would be silently skipped by exactly the invocation the
+# canonical org-wide `script/lint` uses -- a green that linted nothing,
+# which is the failure mode this file exists to prevent. With a single
+# stage there is nothing to skip and `script/lint` needs no `--target`.
+# If a second check is ever added here it must be chained (`FROM lint AS
+# ...`) or carry an explicit ordering edge, never left as a sibling.
+#
+# Only linting is containerised (owner ruling, 2026-08-10: "fmt and fmt
+# check arent docker, just linting"). script/fmt and script/fmt-check run
+# on the host, and the main Dockerfile runs the production build and the
+# format check directly -- see the comment there.
+#
+# The lint is invoked directly below rather than through `make lint` or
+# `script/lint`. That is not a style choice: `script/lint` IS this build,
+# so calling it from inside would recurse into a docker build with no
+# daemon.
+#
+# This repo's lint is a clean Hugo build that surfaces broken internal
+# links and template path problems: `hugo` fails on build errors and
+# --printPathWarnings reports render-target collisions.
+
+# alpine 3.21, 2026-02-28
+FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
+
+WORKDIR /src
+
+# Keep these four instructions byte-identical to the main Dockerfile's,
+# in the same order: Docker keys layers on the instruction chain, not on
+# the file they live in, so an identical prefix means this build is a
+# cache hit against the main image's layers. script/bootstrap compiles
+# the pinned Hugo from source, which is by far the most expensive step
+# here, and it must not be paid twice. The dependency layer is also
+# deliberately above the ARG below, so it stays cached and only the lint
+# step re-runs on every invocation.
+COPY script/ script/
+RUN script/bootstrap
+
+COPY . .
+
+# CHECK_EPOCH is a per-invocation nonce supplied by script/lint. Without
+# it an unchanged tree serves the lint layer from cache: the lint never
+# executes and the build still exits 0, which is precisely the false
+# green this repo already fixed once in the main Dockerfile. Caching is
+# explicitly waived for lint, so the value is expanded into the linted
+# command as well as the guard -- two independent value-keyed
+# invalidation points, so a cache miss never depends on BuildKit's
+# treatment of an unreferenced ARG, and the epoch is visible in the build
+# log. Declared with no default: a default is a constant, and a constant
+# is a stable cache key. The guard makes a bare
+# `docker build -f Dockerfile.lint .` fail loudly instead of silently
+# reusing the empty (and therefore stable) cache key. Keep both
+# references.
+ARG CHECK_EPOCH
+RUN [ -n "$CHECK_EPOCH" ] || exit 1
+RUN echo "lint epoch: ${CHECK_EPOCH}" && hugo --minify --printPathWarnings