Run script/lint from script/check (closes #9)

script/check ran only fmt-check then test, so script/lint was never
invoked anywhere in the gate: make check shims to script/check, the
Dockerfile runs make check, script/cibuild builds the Dockerfile, and
the pre-commit hook calls script/check. The script was dead code that
the README advertised as part of the gate.

It now runs test, lint, fmt-check in the canonical order. script/lint
is hugo --minify --printPathWarnings, which reports render-target
collisions that the plain hugo --minify in script/test does not; that
signal was being discarded.

The gate still modifies no tracked files. script/test and script/lint
both write to public/, which is gitignored and was already written by
script/test before this change.

Corrects the two documents that enumerated the old two-step gate: the
README Entrypoints line for script/check, and the Dockerfile header
comment above the RUN make check that executes it.

script/check

@@ -1,14 +1,16 @@
 #!/bin/sh
 # script/check: run all checks. Our own extension to
-# scripts-to-rule-them-all. Must not modify any files. Runs the
-# read-only formatting check first, then the clean production build.
+# scripts-to-rule-them-all. Must not modify any tracked files. Runs the
+# canonical order: the clean production build, then the lint build that
+# reports path warnings, then the read-only formatting check.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 
 main() {
-    "$SCRIPT_DIR/fmt-check"
     "$SCRIPT_DIR/test"
+    "$SCRIPT_DIR/lint"
+    "$SCRIPT_DIR/fmt-check"
 }
 
 main "$@"