add make check target, CI workflow, and Dockerfile lint stage

- Add lint stage using prebuilt golangci/golangci-lint image for fast
  feedback on formatting and lint issues
- Add build stage using golang:1.24-alpine for tests and compilation
  (replaces sneak/builder:2022-12-08 which has Go 1.19, too old for
  go 1.23 modules)
- Build stage depends on lint stage via COPY --from=lint to ensure
  BuildKit runs both stages
- All Docker base images pinned by sha256 hash
- Add Makefile targets: fmt-check, build, check, hooks
- check target runs fmt-check, lint, and test
- CI workflow simply runs 'docker build .' which implicitly runs all
  checks via the Dockerfile stages
- Update README with new targets and correct Go version requirement
- Remove vendor.tzst/modcache.tzst references from Dockerfile (removed
  in prior commit)

Dockerfile

@@ -1,37 +1,46 @@
 ################################################################################
-#2345678911234567892123456789312345678941234567895123456789612345678971234567898
+# Lint stage — fast feedback on formatting and lint issues
 ################################################################################
-FROM sneak/builder:2022-12-08 AS builder
-ENV DEBIAN_FRONTEND noninteractive
-WORKDIR /build
-COPY ./Makefile ./.golangci.yml ./go.mod ./go.sum /build/
-COPY ./vendor.tzst /build/vendor.tzst
-COPY ./modcache.tzst /build/modcache.tzst
-COPY ./internal ./internal
-COPY ./bin/gitrev.sh ./bin/gitrev.sh
-COPY ./mfer ./mfer
-COPY ./cmd ./cmd
-ARG GITREV unknown
-ARG DRONE_COMMIT_SHA unknown
+# golangci/golangci-lint:v1.64.8
+FROM golangci/golangci-lint@sha256:2987913e27f4eca9c8a39129d2c7bc1e74fbcf77f181e01cea607be437aa5cb8 AS lint
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN make fmt-check
+RUN make lint
 
-RUN mkdir -p "$(go env GOMODCACHE)" && cd "$(go env GOMODCACHE)" && \
-    zstdmt -d --stdout /build/modcache.tzst | tar xf - && \
-    rm /build/modcache.tzst && cd /build
-RUN \
-    cd mfer && go generate . && cd .. && \
-    GOPACKAGESDEBUG=true golangci-lint run ./... && \
-    mkdir vendor && cd vendor && \
-    zstdmt -d --stdout /build/vendor.tzst | tar xf - && rm /build/vendor.tzst && \
-    cd .. && \
-    make mfer.cmd
-RUN rm -rf /build/vendor && go mod vendor && tar -c . | zstdmt -19 > /src.tzst
 ################################################################################
-#2345678911234567892123456789312345678941234567895123456789612345678971234567898
+# Build stage — tests and compilation
 ################################################################################
-## final image
+# golang:1.24-alpine
+FROM golang@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder
+
+# Force BuildKit to run the lint stage by creating a stage dependency
+COPY --from=lint /src/go.sum /dev/null
+
+RUN apk add --no-cache git make zstd
+
+WORKDIR /build
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN make test
+RUN make build
+
+# Archive source for posterity
+RUN go mod vendor && tar -c . | zstd -T0 -19 -o /src.tzst
+
+################################################################################
+# Final image
 ################################################################################
 FROM scratch
 # we put all the source into the final image for posterity, it's small
 COPY --from=builder /src.tzst /src.tzst
-COPY --from=builder /build/mfer.cmd /mfer
+COPY --from=builder /build/bin/mfer /mfer
 ENTRYPOINT ["/mfer"]