Stop the lint and test builds writing an image (closes #123)

script/lint and script/test build their Dockerfile phase with
--output type=cacheonly in place of a tag. The phase still runs
uncached and a failing step still fails the build, but no image is
written: nothing used those images, and writing one out took about 16
seconds of a Go repository's test build. script/cibuild and
script/docker keep their tags. REPO_POLICIES.md, both checklists and
the README now say the gate builds write no image.

Model: opus-5-5

TODO.md

@@ -21,6 +21,14 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-07: `script/lint` and `script/test` now build with
+  `--output type=cacheonly` in place of a tag (issue 123), so they still run
+  their phase uncached and fail on a failing step but write no image. Nothing
+  used those images, and writing one out cost about 16 seconds of a Go
+  repository's test build. `script/cibuild` and `script/docker` keep their tags.
+  `REPO_POLICIES.md`, both checklists and the README no longer say the gate
+  builds are tagged. Not yet tried on the shared runner. Repositories pick this
+  up on their next re-vendor.
 - 2026-10-07: The canonical `package.json` now has `"private": true` in place of
   `"license": "MIT"` (issue 119), so a repository that copies it no longer
   declares MIT whatever its own licence is. yarn does not print "No license