Run lint and tests as Dockerfile phases built with --no-cache (closes #202)

script/check, cibuild, docker, lint, test, setup and install-precommit
are now the copies from sneak/prompts main, unchanged: lint and test
each build their Dockerfile phase with --no-cache, and cibuild runs
bootstrap and check before building the image. The lint phase runs
golangci-lint from the image REPO_POLICIES.md names, with libvips-dev
from apt-get; the test phase runs the tests with a 90-second timeout;
the build stage depends on both. Dockerfile.lint and CHECK_EPOCH are
gone, the formatting check stays on the host, and make docker-versioned
and docker-test call the scripts. Without VERSION the stage that
compiles still takes the version from git describe, per issue 166.

Model: opus-5-5

script/docker

@@ -1,9 +1,8 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname. Like
-# script/cibuild, it passes a new CHECK_EPOCH, so the build runs the
-# checks instead of reusing cached results. Generic: needs no
-# adaptation.
+# Identical in all repos; the tag comes from script/projectname.
+# --no-cache because the gate phases the final stage depends on are RUN
+# steps, and a cached one is a check that did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -11,8 +10,15 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    epoch="$(date +%s)$$"
-    docker build --build-arg CHECK_EPOCH="$epoch" \
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. VERSION is computed here because .dockerignore
+    # excludes .git, so `git describe` in a build stage yields an empty
+    # version without failing.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }