Run lint and tests as Dockerfile phases built with --no-cache (closes #202)

script/check, cibuild, docker, lint, test, setup and install-precommit
are now the sneak/prompts main copies, unchanged: lint and test each
build their Dockerfile phase with --no-cache. The lint phase runs
golangci-lint from the image REPO_POLICIES.md names, with libvips-dev
from apt-get; the test phase runs the tests with a 90-second timeout;
the build stage depends on both. script/bootstrap installs the C
compiler and image libraries only with --cgo, which the test phase and
build stage pass, and refreshes the apt lists before its first apt
install. Dockerfile.lint and CHECK_EPOCH are gone, and make
docker-versioned and docker-test call the scripts. Without VERSION the
build stage still uses git describe, per issue 166.

Model: opus-5-5

script/bootstrap

@@ -4,11 +4,15 @@
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
 # make, or go). The linter is never installed on the host: golangci-lint
-# runs only inside a container, Dockerfile.lint or the Dockerfile lint
-# stage (see script/lint). A C compiler and the CGO image libraries
-# (pkg-config, vips, libheif) are installed for the govips bindings.
-# Both Dockerfiles run this script too, so their build dependencies are
-# the ones listed here.
+# runs only in the lint phase of the Dockerfile (see script/lint).
+#
+#   script/bootstrap         git, make and Go, all the host needs: the
+#                            checks compile pixa in Docker
+#   script/bootstrap --cgo   also a C compiler and the CGO image
+#                            libraries (pkg-config, vips, libheif) for
+#                            the govips bindings, to compile pixa; the
+#                            Dockerfile's test phase and build stage
+#                            run this
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -35,6 +39,10 @@ detect_pkgmgr() {
         if [ "$(id -u)" != "0" ]; then
             SUDO="sudo"
         fi
+        # This runs before the first install only. A fresh image, such
+        # as a CI runner's, has no package lists, and apt-get install
+        # finds no package without them.
+        $SUDO apt-get update
     fi
 }
 
@@ -71,7 +79,16 @@ ensure_cgo_deps() {
     fi
 }
 
+usage() {
+    echo "usage: script/bootstrap [--cgo]" >&2
+    exit 2
+}
+
 main() {
+    case "$*" in
+        "" | --cgo) ;;
+        *) usage ;;
+    esac
     cd "$ROOT"
 
     # Base tooling
@@ -81,8 +98,10 @@ main() {
     # Go toolchain
     if missing go; then pkg_install go golang go go; fi
 
-    # CGO image libraries
-    ensure_cgo_deps
+    # CGO image libraries, only where pixa is compiled
+    if [ "$*" = "--cgo" ]; then
+        ensure_cgo_deps
+    fi
 
     go mod download