Run lint and tests as Dockerfile phases built with --no-cache (closes #202)

script/check, cibuild, docker, lint, test, setup and install-precommit
are now the copies from sneak/prompts main, unchanged: lint and test
each build their Dockerfile phase with --no-cache, and cibuild runs
bootstrap and check before building the image. The lint phase runs
golangci-lint from the image REPO_POLICIES.md names, with libvips-dev
from apt-get; the test phase runs the tests with a 90-second timeout;
the build stage depends on both. Dockerfile.lint and CHECK_EPOCH are
gone, the formatting check stays on the host, and make docker-versioned
and docker-test call the scripts. Without VERSION the stage that
compiles still takes the version from git describe, per issue 166.

Model: opus-5-5

script/bootstrap

@@ -4,11 +4,11 @@
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
 # make, or go). The linter is never installed on the host: golangci-lint
-# runs only inside a container, Dockerfile.lint or the Dockerfile lint
-# stage (see script/lint). A C compiler and the CGO image libraries
-# (pkg-config, vips, libheif) are installed for the govips bindings.
-# Both Dockerfiles run this script too, so their build dependencies are
-# the ones listed here.
+# runs only in the lint phase of the Dockerfile (see script/lint). A C
+# compiler and the CGO image libraries (pkg-config, vips, libheif) are
+# installed for the govips bindings. The Dockerfile's test phase and
+# build stage run this script too, so their build dependencies are the
+# ones listed here.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"