Never regenerate mf.pb.go during checks; fail when it is stale (closes #71)

The test and format scripts regenerated mfer/mf.pb.go whenever
mfer/mf.proto looked newer by mtime, which a fresh checkout often causes,
so make check could rewrite a committed file and needed protoc. Nothing
regenerates it any more except make generate (script/generate), which
also records the hash of mf.proto in mfer/mf.proto.sha256. A Go test
compares that hash with mf.proto and fails, naming make generate, when
they differ; it needs no protoc. The Makefile's mtime rule for mf.pb.go,
make clean's deletion of it and the Dockerfile's touch workarounds are
removed.

Model: opus-5-5

README.md

@@ -72,8 +72,12 @@ provide:
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (`mfer`); used by other scripts
   such as `script/docker`
-- `script/test` — run the test suite (`go test`), regenerating the protobuf code
-  first if it is stale
+- `script/test` — run the test suite (`go test`); one test fails when
+  `mfer/mf.proto` no longer matches the hash `script/generate` recorded
+- `script/generate` — regenerate `mfer/mf.pb.go` from `mfer/mf.proto` and record
+  the hash of that `mfer/mf.proto` in `mfer/mf.proto.sha256`; needs `protoc` and
+  `protoc-gen-go`, and is the only thing that regenerates the committed
+  `mfer/mf.pb.go`
 - `script/fuzz` — fuzz the manifest parser for one minute; run by hand
   (`make fuzz`), never by CI, while `script/test` runs its committed seed corpus
   as ordinary tests