Add pre-built golangci/golangci-lint:v1.64.8 image as a separate lint
stage for fast lint feedback without rebuilding the entire builder.
- Lint stage: installs protobuf-compiler, generates code, runs make lint
- Build stage: pins sneak/builder by sha256, removes inline golangci-lint
- COPY --from=lint forces BuildKit to execute the lint stage
- All images pinned by sha256 digest
- Final stage (FROM scratch) unchanged
