Extract lint into a dedicated stage using the pre-built
golangci/golangci-lint:v2.10.1-alpine image instead of downloading
the binary manually with curl/sha256. This eliminates the slow
multi-arch download+verify step and leverages Docker layer caching.
Structure:
- Lint stage: runs make fmt-check + make lint (with CGO deps for
type-checking govips imports)
- Build stage: depends on lint via COPY --from=lint, runs make test +
builds the binary
- Runtime stage: unchanged
All images pinned by sha256 with version+date comments.
Closes#18
