Add scripts-to-rule-them-all scaffold (closes #4)

Adopt the Scripts to Rule Them All standard for this Hugo site:

- script/ POSIX-sh entrypoints (bootstrap, setup, projectname, test,
  lint, fmt, fmt-check, check, docker, cibuild, precommit,
  install-precommit). The correctness check (test/lint) is a clean
  `hugo --minify` production build; fmt/fmt-check run prettier over the
  repo's own top-level markdown only, leaving content/ untouched.
- Makefile targets reduced to thin shims that call script/NAME, plus a
  convenience serve target for `hugo server`.
- Dockerfile on a sha256-pinned alpine base that installs deps via
  script/bootstrap and runs `make check`, so the image build fails on
  any formatting or Hugo build error; .dockerignore added.
- .gitea/workflows/check.yml runs script/cibuild on push.
- README Entrypoints section documenting the scripts.

Dockerfile

@@ -0,0 +1,18 @@
+# Hugo static-site build image. The build runs `make check` (the
+# read-only prettier docs check plus a clean `hugo --minify` production
+# build), so the image build fails on any formatting or Hugo build
+# error. This is what CI (script/cibuild) runs on every push.
+# alpine 3.21, 2026-02-28
+FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
+
+WORKDIR /src
+
+# Install build dependencies first so the layer caches until the
+# scripts change (script/bootstrap installs git, make, hugo, node/npm).
+COPY script/ script/
+RUN script/bootstrap
+
+COPY . .
+
+# Run all checks - build fails if any check fails.
+RUN make check