Run script/lint from script/check (closes #9)

script/check ran only fmt-check then test, so script/lint was never
invoked anywhere in the gate: make check shims to script/check, the
Dockerfile runs make check, script/cibuild builds the Dockerfile, and
the pre-commit hook calls script/check. The script was dead code that
the README advertised as part of the gate.

It now runs test, lint, fmt-check in the canonical order. script/lint
is hugo --minify --printPathWarnings, which reports render-target
collisions that the plain hugo --minify in script/test does not; that
signal was being discarded.

The gate still modifies no tracked files. script/test and script/lint
both write to public/, which is gitignored and was already written by
script/test before this change.

Corrects the README Entrypoints line for script/check, which described
the old two-step order.

Dockerfile

@@ -1,8 +1,7 @@
-# Hugo static-site build image. The build runs `make check` (a clean
+# Hugo static-site build image. The build runs `make check` (the
-# `hugo --minify` production build, the `--printPathWarnings` lint
+# read-only prettier docs check plus a clean `hugo --minify` production
-# build, then the read-only prettier docs check), so the image build
+# build), so the image build fails on any formatting or Hugo build
-# fails on any formatting or Hugo build error. This is what CI
+# error. This is what CI (script/cibuild) runs on every push.
-# (script/cibuild) runs on every push.
 # alpine 3.21, 2026-02-28
 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709