Use the golangci/golangci-lint image directly as a lint stage that runs
fmt-check and lint, rather than copying the binary into the builder stage.
BuildKit runs lint and test stages in parallel, so formatting and lint
failures surface much faster.
The COPY --from=lint dependency ensures BuildKit always executes the lint
stage (without it, unused stages are silently skipped).
Also add lint to the Makefile check target prereqs to match REPO_POLICIES
(check: test lint fmt-check).
