Check builds keep Go's modules and caches between runs (refs #118)

On sneak's rulings in sneak/prompts#113 and
sneak/prompts#130. REPO_POLICIES.md and
script/test, script/lint, script/docker and script/cibuild are the
sneak/prompts copies at 0653579: the scripts pass a new CACHEBUST value
instead of --no-cache, and the lint and test builds write no image. In
each Dockerfile stage the system packages and the Go module download
come above ARG CACHEBUST; every step that lints, tests or compiles, and
the node stages' yarn install, comes after it. Go's build cache and
golangci-lint's are cache mounts, and both go test runs carry -count=1.
README.md and TODO.md say the same.

Model: opus-5-5

README.md

@@ -58,11 +58,11 @@ either one is broken. We provide:
   defaults (see [Settings](#settings))
 - `script/clean` — remove what `script/build` writes
 - `script/projectname` — print the project name (used for the Docker image tag)
-- `script/test` — build the `test` phase of `Dockerfile` without the cache: the
+- `script/test` — build the `test` phase of `Dockerfile`, writing no image: the
   frontend's unit tests in its `frontend-test` stage, and the backend's Go tests
   with the race detector and coverage. The frontend's production build is left
   to the image build, in the `frontend-build` stage
-- `script/lint` — build the `lint` phase of `Dockerfile` without the cache:
+- `script/lint` — build the `lint` phase of `Dockerfile`, writing no image:
   eslint in its `frontend-lint` stage, and golangci-lint over the Go packages
 - `script/fmt` — format all files (writes): prettier over the JavaScript, CSS,
   HTML and Markdown, then gofmt over `cmd/` and `internal/`. It runs on the
@@ -90,13 +90,25 @@ either one is broken. We provide:
   starts, it checks that the page, and a path that falls back to it, are served
   with `Cache-Control: no-cache` and `Content-Security-Policy`. Not part of
   `script/check`: it takes minutes.
-- `script/docker` — build the image from `Dockerfile` without the build cache,
-  tagged `netwatch` via `script/projectname`
+- `script/docker` — build the image from `Dockerfile`, tagged `netwatch` via
+  `script/projectname`
 - `script/cibuild` — CI entrypoint: runs `script/bootstrap` and `script/check`,
-  then builds the image as `script/docker` does, without the build cache
+  then builds the image as `script/docker` does
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`
 - `script/install-precommit` — install the git pre-commit hook
 
+`script/test`, `script/lint`, `script/docker` and `script/cibuild` each pass a
+new `CACHEBUST` value, so every step in `Dockerfile` that lints, tests or
+compiles runs again even when nothing has changed. Docker keeps the system
+packages and the Go modules from earlier builds until the base image, the step
+that installs them, or `go.mod` and `go.sum` change. The `frontend-build` stage
+is the exception: it installs git again on every image build, because it starts
+from the `frontend-test` stage, whose steps run again on every build. Go's build
+cache and golangci-lint's are kept as well, and each reuses a result only when
+everything it was made from is unchanged. Both `go test` runs carry `-count=1`,
+so no test result is reused. The yarn packages are installed again on every
+build.
+
 ## Responsive layout
 
 The narrow-viewport layout lives in the `max-width: 768px` media block in