Add Makefile shims for cibuild and precommit (closes #34)

script/cibuild and script/precommit both existed and were already the
documented CI and pre-commit entrypoints, but neither had a Makefile
target, so the standing rule to drive the repo through make targets
rather than the underlying tool could not be followed for either.

It matters most for the build. A bare `docker build .` fails closed on
the CHECK_EPOCH guard by design, so script/cibuild is one of only three
supported ways to build an image here, and it was the only one of the
three without a target while `make docker` had one.

The two targets are thin shims in the same style as every other target
and change nothing about what the scripts do. .PHONY was already
complete for the targets that existed and now lists both new ones.

README.md's Entrypoints section gains the script-to-target mapping so
the two documents agree, including the two names that do not match:
script/install-precommit is `make hooks`, and script/precommit is
`make precommit`. It also warns that `make cibuild` runs two container
builds and costs minutes, so nobody types it expecting the runtime the
other make targets have.

README.md

@@ -80,6 +80,17 @@ provide:
 - `script/install-precommit` — install the git pre-commit hook that runs
   `script/check`
 
+Each of those has a Makefile shim of the same name — `make bootstrap`,
+`make setup`, `make test`, `make lint`, `make fmt`, `make fmt-check`,
+`make check`, `make docker`, `make cibuild` — with one exception:
+`script/install-precommit` is `make hooks`. `script/precommit`, which is what
+the installed hook runs, is `make precommit`. Prefer the make targets; the
+`Makefile` is the authoritative list of what this repo can do.
+
+`make cibuild` is the slow one. It runs two container builds rather than
+anything on the host, so budget minutes, not the seconds a `make`-shaped command
+usually implies. That is the cost of the CI build, not a sign of a problem.
+
 Every lint run for this repo happens inside a container, and only the lint does.
 `script/lint` has no host path and no "already inside a container?" branch, so
 what a developer runs and what CI runs are the same build. `script/fmt` and