Check builds keep Go's modules and caches between runs (refs #118)

On sneak's rulings in sneak/prompts#113 and
sneak/prompts#130. REPO_POLICIES.md and
script/test, script/lint, script/docker and script/cibuild are the
sneak/prompts copies at 0653579: the scripts pass a new CACHEBUST value
instead of --no-cache, and the lint and test builds write no image. In
each Dockerfile stage the system packages and the Go module download
come above ARG CACHEBUST; every step that lints, tests or compiles, and
the node stages' yarn install, comes after it. Go's build cache and
golangci-lint's are cache mounts, and both go test runs carry -count=1.
README.md and TODO.md say the same.

Model: opus-5-5

TODO.md

@@ -21,6 +21,19 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-19: check builds keep Go's modules and compiled packages between runs
+  ([#118](https://git.eeqj.de/sneak/netwatch/issues/118)), on sneak's rulings in
+  [prompts#113](https://git.eeqj.de/sneak/prompts/issues/113) and
+  [prompts#130](https://git.eeqj.de/sneak/prompts/issues/130).
+  `REPO_POLICIES.md`, `script/test`, `script/lint`, `script/docker` and
+  `script/cibuild` are the sneak/prompts copies at `0653579`: the scripts pass a
+  new `CACHEBUST` value where they passed `--no-cache`, and the lint and test
+  builds write no image. In each stage of `Dockerfile`, `ARG CACHEBUST` comes
+  after the system packages and the Go module download, and before every step
+  that lints, tests or compiles and the node stages' `yarn install`. Go's build
+  cache and golangci-lint's are cache mounts, and both `go test` runs carry
+  `-count=1`. The test phase's Go caches used to be in memory, empty on every
+  build
 - 2026-10-19: the three unit tests of a check whose result is discarded (its
   round given up, the user paused, or the first round) also check that the
   host's history is still empty, its status still `pending`, and nothing was
@@ -621,9 +634,3 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 - A configurable host list (an environment variable or a config file)
 - Export of the latency history (CSV or JSON)
 - A notification when the health status changes to DEGRADED
-- `make test` within the 20-second target
-  ([#118](https://git.eeqj.de/sneak/netwatch/issues/118)): every run compiles
-  the Go standard library and every dependency with the race detector from
-  nothing. Whether test builds may keep Go's compiled packages between runs
-  waits on sneak's ruling in
-  [prompts#113](https://git.eeqj.de/sneak/prompts/issues/113)