cibuild: run checks on unchanged trees via CHECK_EPOCH (closes #89)

A bare `docker build .` keyed `make fmt-check-go`, `make lint`, the
prettier check, and `make test` on the build context, so on an unchanged
tree every check layer was a cache hit: the build exited 0 in under a
second having run none of them.

Add `ARG CHECK_EPOCH` immediately above the first check RUN in all three
check stages (lint, mdfmt, builder), and have script/cibuild pass a fresh
`--build-arg CHECK_EPOCH` each run. The changing value busts the cache from
that point down, while `go mod download` and `yarn install` above it stay
cached, so the build does not regress to cold. The false claim in
script/cibuild's header comment is corrected.

Running the checks for real surfaces the pre-existing intermittent
internal/cli test timeout (the gpg-subprocess flake in #62 / #67); that
defect is out of scope here.

Model: opus-4-8

Dockerfile

@@ -11,6 +11,10 @@ COPY . .
 # Touch .pb.go so make does not try to regenerate via protoc (file is committed)
 RUN touch mfer/mf.pb.go
 
+# Changing value from script/cibuild; forces the check steps below to
+# re-run instead of being served from a stale layer cache.
+ARG CHECK_EPOCH
+
 # Go half of fmt-check only: this image has no node, so no prettier. The
 # markdown half runs in the mdfmt stage below.
 RUN make fmt-check-go
@@ -27,6 +31,10 @@ RUN yarn install --frozen-lockfile
 
 COPY . .
 
+# Changing value from script/cibuild; forces the check step below to
+# re-run instead of being served from a stale layer cache.
+ARG CHECK_EPOCH
+
 # No make in this image; call the script entrypoint directly.
 RUN script/prettier --check
 
@@ -47,6 +55,10 @@ COPY . .
 # Touch .pb.go so make does not try to regenerate via protoc (file is committed)
 RUN touch mfer/mf.pb.go
 
+# Changing value from script/cibuild; forces the check steps below to
+# re-run instead of being served from a stale layer cache.
+ARG CHECK_EPOCH
+
 RUN make test
 
 # A build context sent as a tar archive, as upaas sends it, keeps its files'