build: unify the gate so root make check covers the backend (closes #16)

Root make check, and with it the pre-commit hook, now gates the Go
backend too. The backend's Makefile targets are shims over
backend/script/*; script/cibuild builds both images and is the
workflow's only build step.

The root make lint runs golangci-lint only in Docker, by building the
lint stage of Dockerfile.backend without the cache; the .golangci.yml
drift check moved into backend/script/lint. script/bootstrap installs
no linter: it reuses a Go at least as new as backend/go.mod asks for,
otherwise installs the pinned, hash-verified release, and links what it
installs into ~/.local/bin without replacing anything it did not
create. The backend version falls back to dev when VERSION is unset or
empty.

Model: opus-5-5

Makefile

@@ -1,9 +1,10 @@
-.PHONY: bootstrap setup dev test lint fmt fmt-check check \
+.PHONY: bootstrap setup dev test lint fmt fmt-check check frontend-check \
 	frontend-viewport-test docker hooks
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
-# of README.md).
+# of README.md). test, lint, fmt, fmt-check and check cover the whole
+# repo: the frontend here and the Go backend in backend/.
 
 bootstrap:
 	@script/bootstrap
@@ -29,6 +30,11 @@ fmt-check:
 check:
 	@script/check
 
+# The frontend half of check, for Dockerfile's node build stage, which
+# has neither Go nor Docker. Use check everywhere else.
+frontend-check:
+	@script/frontend-check
+
 # Responsive-layout verification in a containerised browser. Kept out of
 # check: it needs Docker and takes minutes, where make test has to stay
 # under 20 seconds.