build: unify the gate so root make check covers the backend (closes #16)

Root make check, and with it the pre-commit hook, now gates the Go
backend too. The backend's Makefile targets are shims over
backend/script/*; script/cibuild builds both images and is the
workflow's only build step. Root make test runs both halves within one
30-second timeout.

Root make lint runs golangci-lint only in Docker, by building the lint
stage of Dockerfile.backend without the cache; the .golangci.yml drift
check moved into backend/script/lint. script/bootstrap installs no
linter: it reuses a Go at least as new as backend/go.mod asks for,
otherwise installs the pinned, hash-verified release, linked into
~/.local/bin without replacing anything it did not create. With VERSION
unset or empty, the backend version falls back to git describe inside a
git checkout, then to dev.

Model: opus-5-5

script/lint

@@ -1,12 +1,21 @@
 #!/bin/sh
-# script/lint: run the linter (prettier in check mode).
+# script/lint: lint the whole repo: prettier over the frontend, then the
+# Go linter over backend/.
+#
+# The Go linter runs only in Docker: this builds the lint stage of
+# Dockerfile.backend, the digest-pinned golangci-lint image, which runs
+# the backend's fmt-check and lint targets. --no-cache makes the linter
+# really run every time rather than reuse an earlier result, and the
+# stage is built for its checks alone, so no image is kept.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    yarn prettier --check .
+    "$ROOT/script/frontend-lint"
+    timeout 300 docker build --no-cache --target lint \
+        --output type=cacheonly -f Dockerfile.backend .
 }
 
 main "$@"