Make script/lint fail on any Hugo warning (closes #25)

The lint step in Dockerfile.lint now passes --panicOnWarning alongside
--printPathWarnings. Until now Hugo printed "Duplicate target paths"
when two pages wrote the same output file and still exited 0, so the
lint passed while one page was silently lost. The flag turns that
warning, and every other Hugo warning, into a failed lint.

script/test and the deploy build are unchanged. The comments in
Dockerfile.lint, script/lint and script/check, the README entry for
script/lint, and TODO.md now describe the stricter lint.

Model: opus-5-5

Dockerfile.lint

@@ -21,9 +21,11 @@
 # so calling it from inside would recurse into a docker build with no
 # daemon.
 #
-# This repo's lint is a clean Hugo build that surfaces broken internal
-# links and template path problems: `hugo` fails on build errors and
-# --printPathWarnings reports render-target collisions.
+# This repo's lint is a Hugo build that fails on any build error and on
+# any Hugo warning. --printPathWarnings makes Hugo warn when two pages
+# write the same output path, and --panicOnWarning turns that warning,
+# and every other one, into a failed build. Only the lint is this strict:
+# script/test and the deploy build stay plain `hugo --minify`.
 
 # alpine 3.21, 2026-02-28
 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
@@ -58,4 +60,5 @@ COPY . .
 # references.
 ARG CHECK_EPOCH
 RUN [ -n "$CHECK_EPOCH" ] || exit 1
-RUN echo "lint epoch: ${CHECK_EPOCH}" && hugo --minify --printPathWarnings
+RUN echo "lint epoch: ${CHECK_EPOCH}" && \
+    hugo --minify --printPathWarnings --panicOnWarning