Run lint and tests as Dockerfile phases built with --no-cache (closes #202)

script/check, cibuild, docker, lint, test, setup and install-precommit
are now the copies from sneak/prompts main, unchanged: lint and test
each build their Dockerfile phase with --no-cache, and cibuild runs
bootstrap and check before building the image. The lint phase runs
golangci-lint from the image REPO_POLICIES.md names, with libvips-dev
from apt-get; the test phase runs the tests with a 90-second timeout;
the build stage depends on both. Dockerfile.lint and CHECK_EPOCH are
gone, the formatting check stays on the host, and make docker-versioned
and docker-test call the scripts. Without VERSION the stage that
compiles still takes the version from git describe, per issue 166.

Model: opus-5-5

script/setup

@@ -1,7 +1,6 @@
 #!/bin/sh
 # script/setup: set up the repo for development after a fresh clone:
-# installs dependencies (script/bootstrap) and the git pre-commit hook.
-# Add any repo-specific initialization (db init, .env template) here.
+# installs dependencies and the git pre-commit hook.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"