Stop the lint and test builds writing an image (closes #123)

script/lint and script/test build their Dockerfile phase with
--output type=cacheonly in place of a tag. The phase still runs
uncached and a failing step still fails the build, but no image is
written: nothing used those images, and writing one out took about 16
seconds of a Go repository's test build. script/cibuild and
script/docker keep their tags. REPO_POLICIES.md, both checklists and
the README now say the gate builds write no image.

Model: opus-5-5

prompts/EXISTING_REPO_CHECKLIST.md

@@ -132,16 +132,19 @@ with your task.
       `script/install-precommit`, shimmed by `make hooks`) runs it
 - [ ] README has an **Entrypoints** section documenting the `script/`
       entrypoints and linking the standard
-- [ ] `script/lint` and `script/test` build their phase by name
-      (`docker build --no-cache --target <phase> -t <name>-<phase> .`), and no
-      host invocation anywhere in the repo can produce a lint verdict — grep for
-      the linter's own name across `script/`, the `Makefile` and CI config, not
-      just `script/lint`. A second path is likeliest here: a `make lint-fast`,
-      an older host-versus-container branch, or a CI step calling the binary
+- [ ] `script/lint` and `script/test` each run
+      `docker build --no-cache --target <phase> --output type=cacheonly .`,
+      which builds their phase by name and writes no image, and no host
+      invocation anywhere in the repo can produce a lint verdict — grep for the
+      linter's own name across `script/`, the `Makefile` and CI config, not just
+      `script/lint`. A second path is likeliest here: a `make lint-fast`, an
+      older host-versus-container branch, or a CI step calling the binary
       directly. `script/fmt` and `script/fmt-check` are expected hits and stay
       on the host.
-- [ ] Every `docker build` in `script/` is tagged — an untagged one leaves a
-      dangling image behind on every run, on every host and CI runner
+- [ ] No `docker build` in `script/` leaves a dangling image behind:
+      `script/lint` and `script/test` write no image, and `script/docker` and
+      `script/cibuild` tag theirs. A build that writes an untagged image leaves
+      one behind on every run, on every host and CI runner.
 - [ ] `script/cibuild` runs `script/bootstrap` before `script/check`, and builds
       the image with `--no-cache`. Without the bootstrap the CI run dies in
       `script/fmt-check`, which runs the formatter on the host and finds nothing

prompts/NEW_REPO_CHECKLIST.md

@@ -143,11 +143,14 @@ are thin shims calling them. Model scripts:
       it
 - [ ] `script/setup` / `make setup` — readies a fresh clone: runs `bootstrap`,
       then `install-precommit`, plus repo-specific init
-- [ ] `script/test` / `make test` — `docker build --no-cache --target test .`,
-      tagged; the phase runs real tests, not a no-op (90-second timeout,
-      60-second hard cap on wall time)
-- [ ] `script/lint` / `make lint` — `docker build --no-cache --target lint .`,
-      tagged. No lint verdict may come from a host invocation of the linter.
+- [ ] `script/test` / `make test` —
+      `docker build --no-cache --target test --output type=cacheonly .`, which
+      writes no image; the phase runs real tests, not a no-op (90-second
+      timeout, 60-second hard cap on wall time)
+- [ ] `script/lint` / `make lint` —
+      `docker build --no-cache --target lint --output type=cacheonly .`, which
+      writes no image. No lint verdict may come from a host invocation of the
+      linter.
 - [ ] `script/fmt` / `make fmt` — formats code (writes; native, never in a
       container)
 - [ ] `script/fmt-check` / `make fmt-check` — checks formatting (read-only;
@@ -169,8 +172,9 @@ are thin shims calling them. Model scripts:
       `script/bootstrap` leaves the node and yarn it installs off the `PATH` of
       the shell that called it, so a bare `yarn` exits 127 on a runner carrying
       nothing but docker and git.
-- [ ] Every `docker build` in `script/` is tagged, so no invocation leaves a
-      dangling image behind
+- [ ] No `docker build` in `script/` leaves a dangling image behind:
+      `script/lint` and `script/test` write no image, and `script/docker` and
+      `script/cibuild` tag theirs
 - [ ] `script/precommit` — called by the pre-commit hook; runs `script/check`
 - [ ] `script/install-precommit` — installs the pre-commit hook that runs
       `script/precommit`

prompts/REPO_POLICIES.md

@@ -118,9 +118,8 @@ style conventions are in separate documents:
   and nothing else:
 
     ```sh
-    tag="$(script/projectname)"
-    docker build --no-cache --target lint -t "$tag-lint" .
-    docker build --no-cache --target test -t "$tag-test" .
+    docker build --no-cache --target lint --output type=cacheonly .
+    docker build --no-cache --target test --output type=cacheonly .
     ```
 
     **A stage that is not the last one in the file is built only when the final
@@ -130,12 +129,15 @@ style conventions are in separate documents:
     plain `docker build .` builds the last stage alone and exits 0 having linted
     and tested nothing.
 
-    **Every `docker build` in `script/` is tagged**, here and in
-    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
-    image behind on every invocation, on every developer host and every CI
-    runner; a tagged one replaces the previous image. Each script assigns the
-    tag on its own line before the build, so `set -e` stops it where
-    `script/projectname` fails.
+    **The gate builds write no image.** With `--output type=cacheonly` the phase
+    runs and a failing step fails the build, but the result is not exported.
+    Nothing uses those images, and writing one out is slow: a Go test phase's
+    image holds the toolchain and every compiled package. A build given neither
+    `--output` nor `-t` writes an untagged image and leaves it dangling, on
+    every developer host and every CI runner. `script/cibuild` and
+    `script/docker` build the image that ships and tag it, so each build
+    replaces the previous image; each assigns the tag on its own line before the
+    build, so `set -e` stops it where `script/projectname` fails.
 
     Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
     `eslint`, `prettier` — never through `make lint` or `script/test`, which are