Install Dockerfile build dependencies through script/bootstrap (closes #95)

The Dockerfile lint and build stages and Dockerfile.lint each carried
their own apk add list, a copy of what script/bootstrap installs. They
now copy script/, go.mod and go.sum and run script/bootstrap, so that
layer is reused until one of those changes. script/bootstrap gains a C
compiler check: the golang image has none, and cgo needs one.

The build adds -trimpath and -s -w; CGO_ENABLED=1 stays, as govips
links libvips. ARG VERSION moves to just above the build, so a new
version reruns neither script/bootstrap nor the tests.

Model: opus-5-5

Dockerfile

@@ -3,13 +3,14 @@
 # golangci/golangci-lint:v2.12.2-alpine, 2026-08-07
 FROM golangci/golangci-lint:v2.12.2-alpine@sha256:91b27804074a0bacea298707f016911e60cf0cdbc6c7bf5ccacb5f0606d18d60 AS lint
 
-RUN apk add --no-cache make build-base vips-dev libheif-dev pkgconfig
-
 WORKDIR /src
 
-# Copy go mod files first for better layer caching
+# script/bootstrap installs the build dependencies and downloads the Go
+# modules. Only script/, go.mod and go.sum are copied first, so this
+# layer is reused until one of them changes.
+COPY script/ ./script/
 COPY go.mod go.sum ./
-RUN go mod download
+RUN script/bootstrap
 
 # Copy source code
 COPY . .
@@ -28,20 +29,12 @@ FROM golang:1.25.4-alpine@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66
 # Depend on lint stage passing
 COPY --from=lint /src/go.sum /dev/null
 
-ARG VERSION=dev
-
-# Install build dependencies for CGO image libraries
-RUN apk add --no-cache \
-    build-base \
-    vips-dev \
-    libheif-dev \
-    pkgconfig
-
 WORKDIR /src
 
-# Copy go mod files first for better layer caching
+# Build dependencies and Go modules, as in the lint stage
+COPY script/ ./script/
 COPY go.mod go.sum ./
-RUN GOTOOLCHAIN=auto go mod download
+RUN script/bootstrap
 
 # Copy source code
 COPY . .
@@ -49,8 +42,14 @@ COPY . .
 # Run tests
 RUN make test
 
-# Build with CGO enabled
-RUN CGO_ENABLED=1 GOTOOLCHAIN=auto go build -ldflags "-X main.Version=${VERSION}" -o /pixad ./cmd/pixad
+# VERSION is declared here, not earlier: a new value reruns only the
+# build, not script/bootstrap or the tests. CGO stays enabled for
+# govips; -trimpath keeps build paths out of the binary, and -s -w
+# leave out the symbol table and debug information.
+ARG VERSION=dev
+RUN CGO_ENABLED=1 GOTOOLCHAIN=auto go build -trimpath \
+    -ldflags "-s -w -X main.Version=${VERSION}" \
+    -o /pixad ./cmd/pixad
 
 # Runtime stage
 # alpine:3.21, 2026-02-25