Keep modules, lint cache and system packages in check builds (closes #130)

On sneak's ruling in #130, check
builds keep three more things besides Go's build cache. In each stage of
the canonical Go Dockerfile, the system-package install and the module
download come before ARG CACHEBUST, so Docker keeps those layers until
the base image, the install line, go.mod or go.sum changes. Modules are
kept as a layer, not a cache mount, because Go does not check a cache
mount's files again. golangci-lint run also mounts golangci-lint's cache.
Every step that lints, tests or compiles still comes after ARG CACHEBUST,
both go test runs keep -count=1, and a step that also installs node
packages stays below the line. The policy, checklists, Go style guide,
README and script comments say the same.

Model: opus-5-5

prompts/CODE_STYLEGUIDE_GO.md

@@ -1,6 +1,6 @@
 ---
 title: Code Styleguide — Go
-last_modified: 2026-10-15
+last_modified: 2026-10-18
 ---
 
 1.  Try to hard wrap long lines at 77 characters or less.
@@ -112,9 +112,11 @@ last_modified: 2026-10-15
     both, so a build makes sure the code is in an able-to-be-compiled state,
     linted, and its tests run. Go through `script/cibuild` or `script/docker`
     rather than a bare `docker build .`: they pass a new `CACHEBUST` value on
-    every build, which reruns every `RUN` step and keeps Go's build cache;
-    `--no-cache` would empty it. Without a new value an unchanged tree serves
-    the gate layers from cache and the build reports a green it never ran.
+    every build, which reruns every step that lints, tests or compiles and keeps
+    the system packages, Go's modules and build cache, and golangci-lint's
+    cache; `--no-cache` would throw all of them away. Without a new value an
+    unchanged tree serves the gate layers from cache and the build reports a
+    green it never ran.
 
 1.  Every repo must have a `Makefile`. See
     [Repository Policies](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md)