Stop the lint and test builds writing an image (closes #123)

script/lint and script/test build their Dockerfile phase with
--output type=cacheonly in place of a tag. The phase still runs
uncached and a failing step still fails the build, but no image is
written: nothing used those images, and writing one out took about 16
seconds of a Go repository's test build. script/cibuild and
script/docker keep their tags. REPO_POLICIES.md, both checklists and
the README now say the gate builds write no image.

Model: opus-5-5

prompts/EXISTING_REPO_CHECKLIST.md

@@ -132,16 +132,19 @@ with your task.
       `script/install-precommit`, shimmed by `make hooks`) runs it
 - [ ] README has an **Entrypoints** section documenting the `script/`
       entrypoints and linking the standard
-- [ ] `script/lint` and `script/test` build their phase by name
-      (`docker build --no-cache --target <phase> -t <name>-<phase> .`), and no
-      host invocation anywhere in the repo can produce a lint verdict — grep for
-      the linter's own name across `script/`, the `Makefile` and CI config, not
-      just `script/lint`. A second path is likeliest here: a `make lint-fast`,
-      an older host-versus-container branch, or a CI step calling the binary
+- [ ] `script/lint` and `script/test` each run
+      `docker build --no-cache --target <phase> --output type=cacheonly .`,
+      which builds their phase by name and writes no image, and no host
+      invocation anywhere in the repo can produce a lint verdict — grep for the
+      linter's own name across `script/`, the `Makefile` and CI config, not just
+      `script/lint`. A second path is likeliest here: a `make lint-fast`, an
+      older host-versus-container branch, or a CI step calling the binary
       directly. `script/fmt` and `script/fmt-check` are expected hits and stay
       on the host.
-- [ ] Every `docker build` in `script/` is tagged — an untagged one leaves a
-      dangling image behind on every run, on every host and CI runner
+- [ ] No `docker build` in `script/` leaves a dangling image behind:
+      `script/lint` and `script/test` write no image, and `script/docker` and
+      `script/cibuild` tag theirs. A build that writes an untagged image leaves
+      one behind on every run, on every host and CI runner.
 - [ ] `script/cibuild` runs `script/bootstrap` before `script/check`, and builds
       the image with `--no-cache`. Without the bootstrap the CI run dies in
       `script/fmt-check`, which runs the formatter on the host and finds nothing