build: unify the gate so root make check covers the backend (closes #16)

Root make check, and with it the pre-commit hook, now gates the Go
backend too. The backend's Makefile targets are shims over
backend/script/*; script/cibuild builds both images and is the
workflow's only build step. Root make test runs both halves within one
30-second timeout.

Root make lint runs golangci-lint only in Docker, by building the lint
stage of Dockerfile.backend without the cache; the .golangci.yml drift
check moved into backend/script/lint. script/bootstrap installs no
linter: it reuses a Go at least as new as backend/go.mod asks for,
otherwise installs the pinned, hash-verified release, linked into
~/.local/bin without replacing anything it did not create. With VERSION
unset or empty, the backend version falls back to git describe inside a
git checkout, then to dev.

Model: opus-5-5

Dockerfile.backend

@@ -30,12 +30,11 @@ COPY backend/ .
 
 RUN make test
 
-# The build is driven through the Makefile so there is exactly one
-# definition of the build command; it expands to
+# make build is a shim around backend/script/build, the one definition
+# of the build command:
 # CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=... -X main.Buildarch=..."
-# VERSION is handed over in the environment rather than as a make
-# variable so it still reaches the build if the target is ever turned
-# into a shim around a script.
+# That script reads VERSION from the environment, so it is handed over
+# there rather than as a make variable.
 ARG VERSION=dev
 RUN VERSION="${VERSION}" make build
 

README.md

@@ -45,7 +45,8 @@ halves, so the root `make check` fails if either one is broken. We provide:
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
   git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tags)
-- `script/test` — run `script/frontend-test`, then the backend's Go tests
+- `script/test` — run `script/frontend-test`, then the backend's Go tests, both
+  within one 30-second timeout
 - `script/lint` — run `script/frontend-lint`, then golangci-lint in Docker, by
   building the lint stage of `Dockerfile.backend` without the cache
 - `script/fmt` — format all files (writes): prettier, then gofmt over `backend/`

TODO.md

@@ -32,8 +32,9 @@ latest run passes.
   `Dockerfile.backend` without the cache. `script/bootstrap` installs the pinned
   Go unless the installed one is at least what `backend/go.mod` asks for, links
   what it installs into `~/.local/bin` without replacing anything it did not
-  create, and installs no linter. The backend binary's version falls back to
-  `dev` when `VERSION` is unset or empty
+  create, and installs no linter. Root `make test` runs both halves within one
+  30-second timeout. When `VERSION` is unset or empty, the backend binary's
+  version falls back to `git describe` inside a git checkout, then to `dev`
 - 2026-09-28: frontend reporting client (issue #53): a `Reporter` class posts
   collected samples to `/api/v1/reports` every `reportInterval` (default 60s) as
   a per-host delta, with the report-building step a pure exported function of

backend/README.md

@@ -31,8 +31,9 @@ pattern as the repo root: the targets in `backend/Makefile` are thin shims over
 `test`, `fmt` and `fmt-check`:
 
 - `script/build` — compile the static `netwatch-server` binary with its version
-  and architecture stamped in. The version is `VERSION` from the environment,
-  else `git describe`, else `dev`
+  and architecture stamped in. The version is `VERSION` from the environment;
+  when that is unset or empty, it falls back to `git describe` inside a git
+  checkout, then to `dev`
 - `script/test` — run the Go tests under a 30-second timeout
 - `script/lint` — check `.golangci.yml` against its pinned sha256, then run
   golangci-lint. It runs inside the golangci-lint image of the lint stage of

script/test

@@ -1,14 +1,14 @@
 #!/bin/sh
 # script/test: run the test suite for the whole repo: the frontend at
-# the repo root, then the Go backend in backend/.
+# the repo root, then the Go backend in backend/. Both halves together
+# get 30 seconds; each also keeps its own limit for the Dockerfiles.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    "$ROOT/script/frontend-test"
-    "$ROOT/backend/script/test"
+    timeout 30 sh -c 'script/frontend-test && backend/script/test'
 }
 
 main "$@"