build: unify the gate so root make check covers the backend (closes #16)

Root make check, and with it the pre-commit hook, now gates the Go
backend too. The backend's Makefile targets are shims over
backend/script/*; script/cibuild builds both images and is the
workflow's only build step. Root make test runs both halves within one
30-second timeout.

Root make lint runs golangci-lint only in Docker, by building the lint
stage of Dockerfile.backend without the cache; the .golangci.yml drift
check moved into backend/script/lint. script/bootstrap installs no
linter: it reuses a Go at least as new as backend/go.mod asks for,
otherwise installs the pinned, hash-verified release, linked into
~/.local/bin without replacing anything it did not create. With VERSION
unset or empty, the backend version falls back to git describe inside a
git checkout, then to dev.

Model: opus-5-5

Dockerfile.backend

@@ -30,12 +30,11 @@ COPY backend/ .
 
 RUN make test
 
-# The build is driven through the Makefile so there is exactly one
-# definition of the build command; it expands to
+# make build is a shim around backend/script/build, the one definition
+# of the build command:
 # CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=... -X main.Buildarch=..."
-# VERSION is handed over in the environment rather than as a make
-# variable so it still reaches the build if the target is ever turned
-# into a shim around a script.
+# That script reads VERSION from the environment, so it is handed over
+# there rather than as a make variable.
 ARG VERSION=dev
 RUN VERSION="${VERSION}" make build