cibuild: the org model, which runs every check uncached (closes #37)

script/cibuild was a plain docker build ., so on a tree Docker had
seen before every check step came from the build cache and the build
still passed. It is now the org model from sneak/prompts, byte for
byte: script/bootstrap, script/check, then docker build --no-cache
with the git describe version as the VERSION build argument.

The workflow puts ~/.local/bin, where bootstrap links what it
installs, on the step's PATH. Bootstrap now installs its pinned node
when the installed one is older than 22.12.0, the oldest the
frontend's dependencies accept (puppeteer-core's engines field), as
it already does for Go against backend/go.mod.

Model: opus-5-5

README.md

@@ -36,12 +36,12 @@ The Go backend in `backend/` has its own `script/` directory and shim Makefile
 (see [backend/README.md](backend/README.md)). The root scripts cover both
 halves, so the root `make check` fails if either one is broken. We provide:
 
-- `script/bootstrap` — install all dependencies (pinned node via nvm if needed,
-  yarn via corepack, `yarn install --frozen-lockfile`, the pinned Go unless one
-  at least as new as `backend/go.mod` asks for is installed, and the Go
-  modules), linking what it installs itself into `~/.local/bin`, which has to be
-  on `PATH`. It installs no Go linter and not Docker: `make lint` runs the
-  linter in Docker
+- `script/bootstrap` — install all dependencies (the pinned node via nvm unless
+  one new enough for the frontend's dependencies is installed, yarn via
+  corepack, `yarn install --frozen-lockfile`, the pinned Go unless one at least
+  as new as `backend/go.mod` asks for is installed, and the Go modules), linking
+  what it installs itself into `~/.local/bin`, which has to be on `PATH`. It
+  installs no Go linter and not Docker: `make lint` runs the linter in Docker
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
   git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
@@ -65,7 +65,8 @@ halves, so the root `make check` fails if either one is broken. We provide:
   `script/check`: it needs Docker and takes minutes.
 - `script/docker` — build the image from `Dockerfile` without the build cache,
   tagged `netwatch` via `script/projectname`
-- `script/cibuild` — CI entrypoint: builds the image
+- `script/cibuild` — CI entrypoint: runs `script/bootstrap` and `script/check`,
+  then builds the image as `script/docker` does, without the build cache
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`
 - `script/install-precommit` — install the git pre-commit hook