Add Makefile shims for cibuild and precommit (closes #34)

script/cibuild and script/precommit both existed and were already the
documented CI and pre-commit entrypoints, but neither had a Makefile
target, so the standing rule to drive the repo through make targets
rather than the underlying tool could not be followed for either.

It matters most for the build. A bare `docker build .` fails closed on
the CHECK_EPOCH guard by design, so script/cibuild is one of only three
supported ways to build an image here, and it was the only one of the
three without a target while `make docker` had one.

The two targets are thin shims in the same style as every other target
and change nothing about what the scripts do. .PHONY was already
complete for the targets that existed and now lists both new ones.

README.md's Entrypoints section gains the script-to-target mapping so
the two documents agree, including the two names that do not match:
script/install-precommit is `make hooks`, and script/precommit is
`make precommit`. It also notes that `make cibuild` is the slowest
target, because it is the only one that runs two container builds --
while still taking seconds once the shared script/bootstrap layer is
cached, since Dockerfile.lint's first four instructions are
byte-identical to the main Dockerfile's and the pinned-Hugo compile is
therefore paid once per machine rather than twice.

Two accuracy fixes to text the same section already carried. The
script/install-precommit bullet said the installed hook runs
script/check; the script writes script/precommit into
.git/hooks/pre-commit, and its own header comment says so. And the
Makefile is described as listing the operations you are expected to run
rather than as the authoritative list of everything the repo can do,
which is not literally true: script/projectname is an internal helper
that script/docker calls to compute a tag, and it has no target
deliberately -- a target for it would be noise in the `make<tab>`
listing this change exists to make useful.

TODO.md also loses the stale Future Step asking someone to confirm the
static/_headers file took effect in production. That was confirmed live
on both hostnames on 2026-08-10 and recorded at
#14 , so the item is work
already done.

README.md

@@ -78,18 +78,21 @@ provide:
 - `script/cibuild` — the CI build: `script/lint` first, for fail-fast feedback,
   then the main image, which runs the non-lint checks
 - `script/install-precommit` — install the git pre-commit hook that runs
-  `script/check`
+  `script/precommit`
 
 Each of those has a Makefile shim of the same name — `make bootstrap`,
 `make setup`, `make test`, `make lint`, `make fmt`, `make fmt-check`,
 `make check`, `make docker`, `make cibuild` — with one exception:
 `script/install-precommit` is `make hooks`. `script/precommit`, which is what
 the installed hook runs, is `make precommit`. Prefer the make targets; the
-`Makefile` is the authoritative list of what this repo can do.
+`Makefile` lists the operations you are expected to run.
 
-`make cibuild` is the slow one. It runs two container builds rather than
+`make cibuild` is the slowest target: it is the only one that runs two container
-anything on the host, so budget minutes, not the seconds a `make`-shaped command
+builds, the lint image first and then the main image. The two share the
-usually implies. That is the cost of the CI build, not a sign of a problem.
+`script/bootstrap` layer byte-for-byte, so the pinned-Hugo compile described
+above is paid once per machine rather than twice, and once that layer is cached
+a full `make cibuild` takes seconds. That is the cost of the CI build, not a
+sign of a problem.
 
 Every lint run for this repo happens inside a container, and only the lint does.
 `script/lint` has no host path and no "already inside a container?" branch, so

TODO.md

@@ -50,16 +50,22 @@ leaning on `.gitignore` (https://git.eeqj.de/sneak/lora.vegas/issues/33).
   now lists both. `README.md`'s Entrypoints section gained the script-to-target
   mapping, including the two names that do not match —
   `script/install-precommit` is `make hooks`, and `script/precommit` is
-  `make precommit` — plus a warning that `make cibuild` costs minutes because it
+  `make precommit` — plus a note that `make cibuild` is the slowest target
-  is two container builds, so nobody types it expecting a `make`-shaped runtime.
+  because it is the only one that runs two container builds, while still taking
-  Verified that `make cibuild` earns its green rather than replaying a warm
+  seconds once the shared `script/bootstrap` layer is cached. The section's
-  cache: one invocation ran both builds for real in sequence, each with its own
+  pre-existing `script/install-precommit` bullet, which claimed the installed
-  distinct `CHECK_EPOCH`, with `RUN script/bootstrap` `CACHED` above and no
+  hook runs `script/check`, now says `script/precommit`, which is what the
-  check layer cached below it — the `Dockerfile.lint` build echoed its epoch and
+  script actually writes into `.git/hooks/pre-commit`. The stale Future Step
-  printed hugo's own build table, then the main image build echoed a different
+  asking for post-deploy confirmation of `static/_headers` is dropped here: it
-  epoch, ran `script/test` for the production build and `script/fmt-check` for
+  was confirmed live on both hostnames
-  the formatting check. `make precommit` passes on a clean tree, and
+  (https://git.eeqj.de/sneak/lora.vegas/issues/14). Verified that `make cibuild`
-  `make check` passes
+  earns its green rather than replaying a warm cache: one invocation ran both
+  builds for real in sequence, each with its own distinct `CHECK_EPOCH`, with
+  `RUN script/bootstrap` `CACHED` above and no check layer cached below it — the
+  `Dockerfile.lint` build echoed its epoch and printed hugo's own build table,
+  then the main image build echoed a different epoch, ran `script/test` for the
+  production build and `script/fmt-check` for the formatting check.
+  `make precommit` passes on a clean tree, and `make check` passes
 - 2026-08-10: moved the lint into Docker
   (https://git.eeqj.de/sneak/lora.vegas/issues/38). A new root `Dockerfile.lint`
   runs `hugo --minify --printPathWarnings` as a build step, so a successful
@@ -336,17 +342,6 @@ outside this repo, so nothing there may be picked up as the Next Step.
 - Delete the stale remote branches `feat/initial-site` and `security-audit`;
   only the owner can remove them
   (https://git.eeqj.de/sneak/lora.vegas/issues/15)
-- After the next deploy, confirm the `_headers` file actually took effect, on
-  both `https://lora.vegas/` and `https://www.lora.vegas/`: `curl -sSI` against
-  each must show `strict-transport-security` or `content-security-policy`.
-  Cloudflare Pages silently ignores a malformed `_headers`, and checking
-  `x-content-type-options` would pass either way because the edge sends it
-  regardless. `www` has to be checked too and not just the apex: dropping
-  `includeSubDomains` rests on `www.lora.vegas` being served by this same Pages
-  project, which was established behaviourally from identical response bodies
-  rather than from the Cloudflare dashboard. If `www` turns out not to be
-  covered, the `includeSubDomains` decision has to be revisited
-  (https://git.eeqj.de/sneak/lora.vegas/issues/14)
 - Decide the HSTS `includeSubDomains` and `preload` posture for `lora.vegas`.
   Both are owner calls: neither can be walked back inside the max-age window,
   and `includeSubDomains` binds hostnames this repo does not control