Make script/lint fail on any Hugo warning (closes #25)

The lint step in Dockerfile.lint now passes --panicOnWarning alongside
--printPathWarnings. Until now Hugo printed "Duplicate target paths"
when two pages wrote the same output file and still exited 0, so the
lint passed while one page was silently lost. The flag turns that
warning, and every other Hugo warning, into a failed lint.

script/test and the deploy build are unchanged. The comments in
Dockerfile.lint, script/lint and script/check, the README entry for
script/lint, and TODO.md now describe the stricter lint.

Model: opus-5-5

script/check

@@ -2,7 +2,7 @@
 # script/check: run all checks. Our own extension to
 # scripts-to-rule-them-all. Must not modify any tracked files. Runs the
 # canonical order: the clean production build, then the lint build that
-# reports path warnings, then the read-only formatting check.
+# fails on any Hugo warning, then the read-only formatting check.
 #
 # The lint - and only the lint - runs inside Docker: it is a build of
 # Dockerfile.lint, so this script needs a working docker daemon and has

script/lint

@@ -1,12 +1,13 @@
 #!/bin/sh
 # script/lint: run the lint. This Hugo site has no dedicated linter, so
-# the lint gate is a clean build that surfaces broken internal links and
-# template path problems -- but where it runs is not negotiable: every
-# lint run happens inside a Docker container, so this script does
-# nothing except build Dockerfile.lint. The lint is a build step there,
-# so a successful build is a clean lint. There is deliberately no host
-# fallback and no "already inside a container?" branch: either would be
-# a host lint path wearing a disguise.
+# the lint is a Hugo build that fails on any build error and on any Hugo
+# warning, including two pages that write the same output path. Where
+# it runs is not negotiable. Every lint run happens inside a Docker
+# container, so this script does nothing except build Dockerfile.lint.
+# The lint is a build step there, so a successful build is a clean lint.
+# There is deliberately no host fallback and no "already inside a
+# container?" branch: either would be a host lint path wearing a
+# disguise.
 #
 # No --target: Dockerfile.lint has exactly one stage, so the whole-file
 # build IS the lint. See that file for why a second, sibling stage would