Force check layers to execute on every cibuild run (closes #89)

script/cibuild ran a bare "docker build .". The Dockerfile does "COPY . ."
and then runs the checks, so on an unchanged tree every check layer was a
cache hit: the suite never executed and the build still exited 0. A green
from script/cibuild did not mean the checks had passed, only that they had
passed at some point in the past.

Declare "ARG CHECK_EPOCH" in each stage that runs a check, positioned below
the dependency layers and immediately above the first check, and have
script/cibuild pass a fresh "$(date +%s)" on every invocation. A changed
build arg invalidates every layer below its declaration, so the checks
always execute while the base images, "go mod download" and the "yarn
install" in mdfmt stay cached.

All three check-running stages are covered: lint (fmt-check-go, lint),
mdfmt (prettier --check) and builder (test). ARG is scoped per stage, so a
stage without its own declaration would keep serving a cached pass and be
indistinguishable from a working fix at the exit code.

"--no-cache" was not used: it would also discard "go mod download" and the
yarn install, for no additional guarantee.

The README's build-status claim is accurate again and now says why.

script/cibuild

@@ -6,9 +6,14 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# A bare "docker build ." serves the check layers straight from the Docker
+# layer cache when the tree has not changed, so the build exits 0 without ever
+# running the checks. CHECK_EPOCH changes on every invocation and the
+# Dockerfile declares it above the checks in every stage that runs one, which
+# forces them to execute while leaving the dependency layers cached.
 main() {
     cd "$ROOT"
-    docker build .
+    docker build --build-arg CHECK_EPOCH="$(date +%s)" .
 }
 
 main "$@"