Run script/lint from script/check (closes #9)

script/check ran only fmt-check then test, so script/lint was never
invoked anywhere in the gate: make check shims to script/check, the
Dockerfile runs make check, script/cibuild builds the Dockerfile, and
the pre-commit hook calls script/check. The script was dead code that
the README advertised as part of the gate.

It now runs test, lint, fmt-check in the canonical order. script/lint
is hugo --minify --printPathWarnings, which reports render-target
collisions that the plain hugo --minify in script/test does not; that
signal was being discarded.

The gate still modifies no tracked files. script/test and script/lint
both write to public/, which is gitignored and was already written by
script/test before this change.

Corrects the two documents that enumerated the old two-step gate: the
README Entrypoints line for script/check, and the Dockerfile header
comment above the RUN make check that executes it.

README.md

@@ -55,7 +55,8 @@ provide:
 - `script/lint` — a clean build that surfaces broken links and path collisions
 - `script/fmt` — format the repo's own top-level markdown docs with prettier
 - `script/fmt-check` — check that formatting (read-only)
-- `script/check` — run `script/fmt-check` then `script/test`; modifies nothing
+- `script/check` — run `script/test`, `script/lint`, then `script/fmt-check`;
+  modifies no tracked files
 - `script/docker` — build the Docker image tagged with the project name
 - `script/cibuild` — the CI build (`docker build .`); the Dockerfile runs
   `make check`