Gate the build on Docker lint and test phases (closes #40, closes #30)

Per the owner ruling on issue 40, linting and testing are phases of the
main Dockerfile rather than a separate lint file. script/lint and
script/test build one phase each by name with caching disabled, and the
final stage copies a harmless file from each so the image cannot be built
unless both passed. A stage that is not the last is built only when
something depends on it or --target names it, so the gates are invoked by
name and the edges kept. script/check runs the gates and builds no image
of its own; script/cibuild bootstraps first, because CI runs it alone and
fmt-check is native. fmt and fmt-check source nvm for the pinned node
before calling yarn, which bootstrap installs but leaves off its caller's
PATH. Every build in script/ is tagged and uncached. Issue 30 closes too:
a container has its own lint cache and lock.

Model: opus-5

README.md

@@ -116,20 +116,24 @@ alpine. We provide:
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (our own extension); used by
   `script/docker` for the image tag
-- `script/test` — run the test suite (no tests defined here)
-- `script/lint` — lint the markdown files with prettier
-- `script/fmt` — format all markdown files with prettier (writes)
-- `script/fmt-check` — check formatting (read-only)
+- `script/test` — `docker build --no-cache --target test -t prompts-test .`,
+  building the `test` phase of the `Dockerfile` (no tests defined here)
+- `script/lint` — `docker build --no-cache --target lint -t prompts-lint .`,
+  building the `lint` phase, which runs prettier over the markdown files
+- `script/fmt` — format all markdown files with prettier (writes; native, not in
+  a container)
+- `script/fmt-check` — check formatting (read-only; native)
 - `script/check` — run all checks: `test`, `lint`, `fmt-check` (our own
-  extension)
-- `script/docker` — build the Docker image, tagged via `script/projectname`
-  (byte-identical across repos); same `--no-cache` and `VERSION` as
-  `script/cibuild`
-- `script/cibuild` — cd to the repo root, compute `version` from `git describe`,
-  then `docker build --no-cache --build-arg VERSION="$version" .` (what CI runs;
-  the image build runs `script/check`, `--no-cache` is what stops Docker serving
-  those checks from cache on an unchanged tree, and the version is computed on
-  the host because `.dockerignore` excludes `.git`)
+  extension); builds no image of its own
+- `script/docker` —
+  `docker build --no-cache --build-arg VERSION="$version" -t prompts .`, the tag
+  coming from `script/projectname` (byte-identical across repos)
+- `script/cibuild` — cd to the repo root, run `script/bootstrap`, run
+  `script/check`, compute `version` from `git describe`, then
+  `docker build --no-cache --build-arg VERSION="$version" -t prompts .` (what CI
+  runs; it bootstraps because CI checks out and runs this alone while
+  `script/fmt-check` is native, and the version is computed on the host because
+  `.dockerignore` excludes `.git`)
 - `script/precommit` — run by the git pre-commit hook (our own extension); calls
   `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own