add make check target, CI workflow, and Dockerfile lint stage

- Add lint stage using prebuilt golangci/golangci-lint image for fast
  feedback on formatting and lint issues
- Add build stage using golang:1.24-alpine for tests and compilation
  (replaces sneak/builder:2022-12-08 which has Go 1.19, too old for
  go 1.23 modules)
- Build stage depends on lint stage via COPY --from=lint to ensure
  BuildKit runs both stages
- All Docker base images pinned by sha256 hash
- Add Makefile targets: fmt-check, build, check, hooks
- check target runs fmt-check, lint, and test
- CI workflow simply runs 'docker build .' which implicitly runs all
  checks via the Dockerfile stages
- Update README with new targets and correct Go version requirement
- Remove vendor.tzst/modcache.tzst references from Dockerfile (removed
  in prior commit)

Makefile

@@ -13,7 +13,7 @@ GOLDFLAGS += -X main.Version=$(VERSION)
 GOLDFLAGS += -X main.Gitrev=$(GITREV_BUILD)
 GOFLAGS := -ldflags "$(GOLDFLAGS)"
 
-.PHONY: docker default run ci test fixme
+.PHONY: docker default run ci test fixme check fmt-check lint build hooks
 
 default: fmt test
 
@@ -23,7 +23,7 @@ run: ./bin/mfer
 
 ci: test
 
-test: $(SOURCEFILES) mfer/mf.pb.go
+test:
 	go test -v --timeout 10s ./...
 
 $(PROTOC_GEN_GO):
@@ -42,6 +42,9 @@ bin/mfer: $(SOURCEFILES) mfer/mf.pb.go
 	protoc --version
 	cd cmd/mfer && go build -tags urfave_cli_no_docs -o ../../bin/mfer $(GOFLAGS) .
 
+build:
+	cd cmd/mfer && go build -tags urfave_cli_no_docs -o ../../bin/mfer $(GOFLAGS) .
+
 clean:
 	rm -rfv mfer/*.pb.go bin/mfer cmd/mfer/mfer *.dockerimage
 
@@ -51,31 +54,31 @@ fmt: mfer/mf.pb.go
 	-prettier -w *.json
 	-prettier -w *.md
 
+fmt-check:
+	@echo "==> Checking formatting..."
+	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
+
 lint:
-	golangci-lint run
-	sh -c 'test -z "$$(gofmt -l .)"'
+	golangci-lint run ./...
+
+# Run all checks (formatting, linting, tests) without modifying files
+check: fmt-check lint test
+
+hooks:
+	@echo "Installing git hooks..."
+	@mkdir -p .git/hooks
+	@echo '#!/bin/sh' > .git/hooks/pre-commit
+	@echo 'make check' >> .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit
+	@echo "Pre-commit hook installed."
 
 docker: sneak-mfer.$(ARCH).tzst.dockerimage
 
-sneak-mfer.$(ARCH).tzst.dockerimage: $(SOURCEFILES) vendor.tzst modcache.tzst
+sneak-mfer.$(ARCH).tzst.dockerimage: $(SOURCEFILES)
 	docker build --progress plain --build-arg GITREV=$(GITREV_BUILD) -t sneak/mfer .
-	docker save sneak/mfer | pv | zstdmt -19 > $@
+	docker save sneak/mfer | pv | zstd -T0 -19 > $@
 	du -sh $@
 
 godoc:
 	open http://127.0.0.1:6060
 	godoc -http=:6060
-
-vendor.tzst: go.mod go.sum
-	go mod tidy
-	go mod vendor
-	cd vendor && tar -c . | pv | zstdmt -19 > $(PWD)/$@.tmp
-	rm -rf vendor
-	mv $@.tmp $@
-
-modcache.tzst: go.mod go.sum
-	go mod tidy
-	cd $(HOME)/go/pkg && chmod -R u+rw . && rm -rf mod sumdb
-	go mod download -x
-	cd $(shell go env GOMODCACHE) && tar -c . | pv | zstdmt -19 > $(PWD)/$@.tmp
-	mv $@.tmp $@