Deploy main 5e572ce to prod (#198)

main's tree, with next merged on 26 October, as one commit onto prod, on sneak's order.

Model: opus-5-5
Co-authored-by: clawbot <clawbot@noreply.example.org>

script/lint

@@ -1,20 +1,27 @@
 #!/bin/sh
-# script/lint: lint the whole repo: prettier over the frontend, then the
-# Go linter over backend/.
+# script/lint: run the linter. Linting is a phase of the Dockerfile and
+# this builds that phase alone; the linter is never installed or run on
+# a developer host, where a shared result cache and a host-global lock
+# make its answer untrustworthy.
 #
-# The Go linter runs only in Docker: this builds the lint stage of
-# Dockerfile, the digest-pinned golangci-lint image, which runs the
-# backend's fmt-check and lint targets. --no-cache makes the linter
-# really run every time rather than reuse an earlier result, and the
-# stage is built for its checks alone, so no image is kept.
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. A new CACHEBUST value reruns every RUN step after
+# the ARG CACHEBUST line, since a cached lint layer is a lint that did
+# not run; unlike --no-cache, it keeps the layers above that line and
+# the cache mounts. This relies on every stage of the Dockerfile
+# declaring ARG CACHEBUST before every step that lints, tests or
+# compiles; a stage without that line is served from cache on an
+# unchanged tree, with no warning.
+# --output type=cacheonly writes no image, since nothing uses one.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    "$ROOT/script/frontend-lint"
-    timeout 300 docker build --no-cache --target lint \
+    docker build --build-arg CACHEBUST="$(date +%s)-$$" \
+        --target lint \
         --output type=cacheonly .
 }