Run all linting in Docker via Dockerfile.lint (closes #90)

script/lint now only builds the new Dockerfile.lint, which copies the
repo into the pinned golangci-lint image and runs the linter as a build
step, so a successful build is a clean lint. It builds with --no-cache,
because a cached build runs no linter, and removes the image it tagged
when it exits. The main Dockerfile lint stage calls golangci-lint
directly, since make lint now needs Docker. Nothing installs or runs
golangci-lint on the host any more: bootstrap and the Makefile drop the
install, and script/fmt drops golangci-lint run --fix. The gofmt check
script/lint repeated stays in script/fmt-check.

Model: opus-5-5

script/fmt

@@ -19,7 +19,6 @@ main() {
     cd "$ROOT"
     ensure_pb
     gofumpt -l -w mfer internal cmd
-    golangci-lint run --fix
     # Markdown and JSON, over the same file set script/fmt-check verifies.
     "$SCRIPT_DIR/prettier" --write
 }