WIP: cache-bust the make check layer via CHECK_EPOCH (refs #23)

Incomplete - do not merge. Preserved so the analysis is not lost.

The Dockerfile declares an ARG CHECK_EPOCH with no default, guards
against it being unset, and expands it into the RUN line so the check
layer is invalidated on every invocation while the script/bootstrap
toolchain layer above it still caches. script/cibuild generates a
per-invocation value.

Known incomplete:

- script/docker was never updated to pass CHECK_EPOCH, so `make docker`
  would fail the guard. The Dockerfile header already claims it does.
  That claim is currently false.
- Diverges from the canonical upstream shape tracked in prompts #26;
  the intended next step was to simplify to match it rather than keep
  the bespoke guard.
- No verification was run: neither the two-consecutive-runs proof nor
  the deliberate-failure proof required by the issue.

script/cibuild

@@ -2,13 +2,29 @@
 # script/cibuild: run the CI build. The Dockerfile runs `make check`,
 # so a successful build implies all checks pass. The Gitea workflow
 # runs this on push.
+#
+# That implication only holds because of CHECK_EPOCH. Docker keys the
+# `RUN make check` layer on content, so on an unchanged tree it is
+# served from cache: the checks never execute and the build still exits
+# 0. Passing a value that differs on every invocation invalidates that
+# layer and everything below it, while leaving the script/bootstrap
+# toolchain layer above it cached.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build .
+    # Assigned to a variable rather than substituted inline in the
+    # argument list: a command substitution that fails inside an
+    # argument does not trip `set -e`, so the inline form would silently
+    # pass an empty string and restore the cached false green. As the
+    # whole of an assignment, its exit status is the command's and
+    # `set -e` catches it. `%N` keeps two invocations in the same second
+    # distinct; busybox date silently drops `%N` and exits 0, so `$$` is
+    # appended to cover that case.
+    epoch="$(date +%s%N)$$"
+    docker build --build-arg CHECK_EPOCH="$epoch" .
 }
 
 main "$@"