add make check target, CI workflow, and Dockerfile lint stage

- Add lint stage using prebuilt golangci/golangci-lint image for fast
  feedback on formatting and lint issues
- Add build stage using golang:1.24-alpine for tests and compilation
  (replaces sneak/builder:2022-12-08 which has Go 1.19, too old for
  go 1.23 modules)
- Build stage depends on lint stage via COPY --from=lint to ensure
  BuildKit runs both stages
- All Docker base images pinned by sha256 hash
- Add Makefile targets: fmt-check, build, check, hooks
- check target runs fmt-check, lint, and test
- CI workflow simply runs 'docker build .' which implicitly runs all
  checks via the Dockerfile stages
- Update README with new targets and correct Go version requirement
- Remove vendor.tzst/modcache.tzst references from Dockerfile (removed
  in prior commit)

.gitea/workflows/check.yml

@@ -0,0 +1,13 @@
+name: check
+on:
+  push:
+    branches: [main, next]
+  pull_request:
+    branches: [main, next]
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13894f8d5 # v4
+      - name: Build Docker image (runs make check internally)
+        run: docker build .