Run script/lint from script/check (closes #9)

script/check ran only fmt-check then test, so script/lint was never
invoked anywhere in the gate: make check shims to script/check, the
Dockerfile runs make check, script/cibuild builds the Dockerfile, and
the pre-commit hook calls script/check. The script was dead code that
the README advertised as part of the gate.

It now runs test, lint, fmt-check in the canonical order. script/lint
is hugo --minify --printPathWarnings, which reports render-target
collisions that the plain hugo --minify in script/test does not; that
signal was being discarded.

The gate still modifies no tracked files. script/test and script/lint
both write to public/, which is gitignored and was already written by
script/test before this change.

Corrects the two documents that enumerated the old two-step gate: the
README Entrypoints line for script/check, and the Dockerfile header
comment above the RUN make check that executes it.

TODO.md

@@ -25,6 +25,13 @@ Update `README.md` accordingly.
 
 # Completed Steps
 
+- 2026-08-09: made `script/check` run `script/lint` (closes #9). It previously
+  ran only `fmt-check` then `test`, so `script/lint` executed nowhere — not in
+  `make check`, not in the pre-commit hook, and not in CI, even though the
+  `Dockerfile` runs `make check` and `script/cibuild` builds it. It now runs
+  `test`, `lint`, `fmt-check` in the canonical order, so the
+  `hugo --printPathWarnings` render-target-collision signal is no longer
+  discarded. `README.md`'s Entrypoints line was corrected to match
 - 2026-08-09: hash-pinned every external reference in
   `.gitea/workflows/deploy.yml` (closes #7): both job container images are
   pinned by digest, all three `uses:` are pinned by 40-hex commit SHA, and the