Run all linting in Docker via Dockerfile.lint (closes #90)

script/lint now only builds the new Dockerfile.lint, which copies the
repo into the pinned golangci-lint image and runs the linter as a build
step, so a successful build is a clean lint. It builds with --no-cache,
because a cached build runs no linter, and removes the image it tagged
when it exits. The main Dockerfile lint stage calls golangci-lint
directly, since make lint now needs Docker. Nothing installs or runs
golangci-lint on the host any more: bootstrap and the Makefile drop the
install, and script/fmt drops golangci-lint run --fix. The gofmt check
script/lint repeated stays in script/fmt-check.

Model: opus-5-5

README.md

@@ -35,9 +35,9 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call them. We
 provide:
 
-- `script/bootstrap` — install all dependencies (Go, golangci-lint, Go module
-  download, and node/yarn plus the prettier version pinned in
-  `package.json`/`yarn.lock`), idempotently
+- `script/bootstrap` — install all dependencies (Go, Go module download, and
+  node/yarn plus the prettier version pinned in `package.json`/`yarn.lock`),
+  idempotently; golangci-lint is not installed, it runs only in Docker
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (`mfer`); used by other scripts
@@ -47,9 +47,10 @@ provide:
 - `script/fuzz` — fuzz the manifest parser for one minute; run by hand
   (`make fuzz`), never by CI, while `script/test` runs its committed seed corpus
   as ordinary tests
-- `script/lint` — run `golangci-lint` and verify `gofmt` cleanliness
-- `script/fmt` — format all code and docs (writes): `gofumpt`,
-  `golangci-lint run --fix`, and `script/prettier --write`
+- `script/lint` — run `golangci-lint` in Docker: builds `Dockerfile.lint`, whose
+  build runs the linter, uncached so it runs every time, then removes the image
+- `script/fmt` — format all code and docs (writes): `gofumpt` and
+  `script/prettier --write`
 - `script/prettier` — run prettier over the repository's canonical file set
   (Markdown and JSON, minus `.prettierignore`) in the given mode, `--write` or
   `--check`; the single definition of that file set, so `script/fmt` and
@@ -75,11 +76,10 @@ yet. Primary development happens on a privately-run Gitea instance at
 [tracked there](https://git.eeqj.de/sneak/mfer/issues).
 
 Changes must always be formatted with a standard `go fmt`, syntactically valid,
-and must pass the linting defined in the repository (presently only the
-`golangci-lint` defaults), which can be run with a `make lint`. The `main`
-branch is protected and all changes must be made via
-[pull requests](https://git.eeqj.de/sneak/mfer/pulls) and pass CI to be merged.
-Any changes submitted to this project must also be
+and must pass the linting defined in the repository's `.golangci.yml`, which
+`make lint` runs in Docker. The `main` branch is protected and all changes must
+be made via [pull requests](https://git.eeqj.de/sneak/mfer/pulls) and pass CI to
+be merged. Any changes submitted to this project must also be
 [WTFPL-licensed](https://wtfpl.net) to be considered.
 
 See [`REPO_POLICIES.md`](REPO_POLICIES.md) for detailed coding standards,