feat: split Dockerfile into dedicated lint stage

Add pre-built golangci/golangci-lint:v1.64.8 image as a separate lint
stage for fast lint feedback without rebuilding the entire builder.

- Lint stage: installs protobuf-compiler, generates code, runs make lint
- Build stage: pins sneak/builder by sha256, removes inline golangci-lint
- COPY --from=lint forces BuildKit to execute the lint stage
- All images pinned by sha256 digest
- Final stage (FROM scratch) unchanged

Dockerfile

@@ -1,9 +1,27 @@
 ################################################################################
 #2345678911234567892123456789312345678941234567895123456789612345678971234567898
 ################################################################################
-FROM sneak/builder:2022-12-08 AS builder
+# Lint stage — fast feedback on formatting and lint issues
+# golangci/golangci-lint:v1.64.8
+FROM golangci/golangci-lint@sha256:2987913e27f4eca9c8a39129d2c7bc1e74fbcf77f181e01cea607be437aa5cb8 AS lint
+WORKDIR /src
+RUN apt-get update && apt-get install -y --no-install-recommends protobuf-compiler && rm -rf /var/lib/apt/lists/*
+COPY go.mod go.sum ./
+RUN go mod download
+RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.28.1
+COPY . .
+RUN cd mfer && go generate .
+RUN make lint
+################################################################################
+#2345678911234567892123456789312345678941234567895123456789612345678971234567898
+################################################################################
+# Build stage
+# sneak/builder:2022-12-08
+FROM sneak/builder@sha256:d61175320b02b04eb2cada3005833494ce8a4032647e4202dcb3551cf0b56f5a AS builder
 ENV DEBIAN_FRONTEND noninteractive
 WORKDIR /build
+# Force BuildKit to run the lint stage by creating a stage dependency
+COPY --from=lint /src/go.sum /dev/null
 COPY ./Makefile ./.golangci.yml ./go.mod ./go.sum /build/
 COPY ./vendor.tzst /build/vendor.tzst
 COPY ./modcache.tzst /build/modcache.tzst
@@ -19,7 +37,6 @@ RUN mkdir -p "$(go env GOMODCACHE)" && cd "$(go env GOMODCACHE)" && \
     rm /build/modcache.tzst && cd /build
 RUN \
     cd mfer && go generate . && cd .. && \
-    GOPACKAGESDEBUG=true golangci-lint run ./... && \
     mkdir vendor && cd vendor && \
     zstdmt -d --stdout /build/vendor.tzst | tar xf - && rm /build/vendor.tzst && \
     cd .. && \