build: unify the gate so root make check covers the backend (closes #16)

Root make check, and with it the pre-commit hook, now gates the Go
backend too. The backend's Makefile targets are shims over
backend/script/*; script/cibuild builds both images and is the
workflow's only build step.

The root make lint runs golangci-lint only in Docker, by building the
lint stage of Dockerfile.backend without the cache; the .golangci.yml
drift check moved into backend/script/lint. script/bootstrap installs
no linter: it reuses a Go at least as new as backend/go.mod asks for,
otherwise installs the pinned, hash-verified release, and links what it
installs into ~/.local/bin without replacing anything it did not
create. The backend version falls back to dev when VERSION is unset or
empty.

Model: opus-5-5

TODO.md

@@ -23,6 +23,17 @@ latest run passes.
 
 # Completed Steps
 
+- 2026-09-28: unified the gate (issue #16): the root `make check` covers the Go
+  backend as well as the frontend, and the pre-commit hook with it; the backend
+  moved onto scripts-to-rule-them-all (`backend/script/*`, `backend/Makefile` as
+  shims, its duplicate hook installer removed); `script/cibuild` builds both
+  images and is the workflow's only build step. The root `make lint` runs
+  golangci-lint only in Docker, by building the lint stage of
+  `Dockerfile.backend` without the cache. `script/bootstrap` installs the pinned
+  Go unless the installed one is at least what `backend/go.mod` asks for, links
+  what it installs into `~/.local/bin` without replacing anything it did not
+  create, and installs no linter. The backend binary's version falls back to
+  `dev` when `VERSION` is unset or empty
 - 2026-09-28: frontend reporting client (issue #53): a `Reporter` class posts
   collected samples to `/api/v1/reports` every `reportInterval` (default 60s) as
   a per-host delta, with the report-building step a pure exported function of