Run lint and tests as Dockerfile phases built with --no-cache (closes #202)

script/check, cibuild, docker, lint, test, setup and install-precommit
are now the copies from sneak/prompts main, unchanged: lint and test
each build their Dockerfile phase with --no-cache, and cibuild runs
bootstrap and check before building the image. The lint phase runs
golangci-lint from the image REPO_POLICIES.md names, with libvips-dev
from apt-get; the test phase runs the tests with a 90-second timeout;
the build stage depends on both. Dockerfile.lint and CHECK_EPOCH are
gone, the formatting check stays on the host, and make docker-versioned
and docker-test call the scripts. Without VERSION the stage that
compiles still takes the version from git describe, per issue 166.

Model: opus-5-5

TODO.md

@@ -31,6 +31,21 @@ P2: security: per-IP rate limiting on the image routes
 
 # Completed Steps
 
+- 2026-10-04 lint and tests run as the `lint` and `test` phases of the
+  `Dockerfile`, built with `--no-cache` (closes #202): `script/check`,
+  `script/cibuild`, `script/docker`, `script/lint`, `script/test`,
+  `script/setup` and `script/install-precommit` are now the copies from
+  `sneak/prompts` `main`, unchanged. The `lint` phase runs golangci-lint from
+  the image `REPO_POLICIES.md` names, with `libvips-dev` from `apt-get`; the
+  `test` phase runs the tests with a 90-second timeout; the build stage depends
+  on both. `Dockerfile.lint` and the `CHECK_EPOCH` build argument are gone, the
+  formatting check runs on the host, and `make docker-versioned` and
+  `make docker-test` call the scripts. `script/bootstrap`, `script/fmt`,
+  `script/fmt-check`, `script/precommit` and `script/projectname` stay pixa's
+  own: Go and libvips, `gofmt`, the `go mod tidy` guard, the name. The stage
+  that compiles still takes the version from `git describe` when no `VERSION` is
+  given, per https://git.eeqj.de/sneak/pixa/issues/166, so the copied scripts'
+  comment that `.dockerignore` leaves out `.git` does not hold for pixa.
 - 2026-10-04 local config files stay out of the Docker build context (closes
   #211): `.dockerignore` now leaves out `config.yaml` and `config.dev.yml` in
   every directory and in any letter case, the local config files `.gitignore`