Run lint and tests as Dockerfile phases built with --no-cache (closes #202)

script/check, cibuild, docker, lint, test, setup and install-precommit
are now the sneak/prompts main copies, unchanged: lint and test each
build their Dockerfile phase with --no-cache. The lint phase runs
golangci-lint from the image REPO_POLICIES.md names, with libvips-dev
from apt-get; the test phase runs the tests with a 90-second timeout;
the build stage depends on both. script/bootstrap installs the C
compiler and image libraries only with --cgo, which the test phase and
build stage pass, and refreshes the apt lists before its first apt
install. Dockerfile.lint and CHECK_EPOCH are gone, and make
docker-versioned and docker-test call the scripts. Without VERSION the
build stage still uses git describe, per issue 166.

Model: opus-5-5

README.md

@@ -92,11 +92,11 @@ another part of pixa failed to stop. A request not finished by then is cut off.
 
 Outside Docker, pixa needs libvips (the image has 8.15) and libheif to run, as
 it uses libvips through CGO; building it also needs their development files,
-`pkg-config` and a C compiler. `script/bootstrap --cgo` installs all of these,
+`pkg-config` and a C compiler. `script/bootstrap --cgo` installs all of these
-as the `Dockerfile` does where it compiles pixa. Plain `script/bootstrap`, which
+with nix, apt, brew or apk, as the `Dockerfile` does where it compiles pixa.
-`script/setup` and `script/cibuild` run, installs only git, make and Go: the
+Plain `script/bootstrap`, which `script/setup` and `script/cibuild` run,
-checks compile pixa in Docker, so the host needs none of the C libraries. Docker
+installs only git, make and Go: the checks compile pixa in Docker, so the host
-itself must already be installed.
+needs none of the C libraries. Docker itself must already be installed.
 
 ## Running under upaas