build: unify the gate so root make check covers the backend (closes #16)

Root make check, and with it the pre-commit hook, now gates the Go
backend too. The backend's Makefile targets are shims over
backend/script/*; script/cibuild builds both images and is the
workflow's only build step. Root make test runs both halves within one
30-second timeout.

Root make lint runs golangci-lint only in Docker, by building the lint
stage of Dockerfile.backend without the cache; the .golangci.yml drift
check moved into backend/script/lint. script/bootstrap installs no
linter: it reuses a Go at least as new as backend/go.mod asks for,
otherwise installs the pinned, hash-verified release, linked into
~/.local/bin without replacing anything it did not create. With VERSION
unset or empty, the backend version falls back to git describe inside a
git checkout, then to dev.

Model: opus-5-5

backend/script/lint

@@ -0,0 +1,32 @@
+#!/bin/sh
+# script/lint: run golangci-lint over the backend. This runs inside the
+# lint stage of Dockerfile.backend, whose digest-pinned golangci-lint
+# image provides the linter; nothing installs golangci-lint on the host.
+# From a checkout, run `make lint` at the repo root, which builds that
+# stage.
+#
+# .golangci.yml is standardized org-wide and must never be edited here
+# (REPO_POLICIES.md). Its last silent drift replaced the v2 schema with
+# v1 keys, which left every threshold in the file inert while the build
+# stayed green. So the file is first checked against the canonical
+# copy's sha256: a local comparison, no network, nothing unpinned.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+GOLANGCI_CONFIG_SHA256="021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb"
+
+main() {
+    cd "$ROOT"
+    actual="$(sha256sum .golangci.yml | cut -d' ' -f1)"
+    if [ "$actual" != "$GOLANGCI_CONFIG_SHA256" ]; then
+        echo ".golangci.yml has drifted from the org standard." >&2
+        echo "  expected $GOLANGCI_CONFIG_SHA256" >&2
+        echo "  actual   $actual" >&2
+        echo "Restore it verbatim from sneak/prompts; do not edit it." >&2
+        exit 1
+    fi
+    golangci-lint run ./...
+}
+
+main "$@"