Gate the build on Docker lint and test phases (closes #40, closes #30)

Per the owner ruling on issue 40, linting and testing are phases of the
main Dockerfile rather than a separate lint file. script/lint and
script/test each build one phase by name with caching disabled, and the
final stage copies a harmless file from each so the image cannot be built
unless both passed — the ordering trick already in template-app-go's
Dockerfile, extended to the test phase. A phase that is not the last
stage is built only when something depends on it or --target names it, so
the gates are always invoked by name and the edges are kept. Every build
in script/ is tagged. No config verify step; fmt stays on the host. This
closes issue 30 too: a container has its own result cache and lock.

Model: opus-5

README.md

@@ -116,20 +116,23 @@ alpine. We provide:
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (our own extension); used by
   `script/docker` for the image tag
-- `script/test` — run the test suite (no tests defined here)
-- `script/lint` — lint the markdown files with prettier
-- `script/fmt` — format all markdown files with prettier (writes)
-- `script/fmt-check` — check formatting (read-only)
-- `script/check` — run all checks: `test`, `lint`, `fmt-check` (our own
-  extension)
-- `script/docker` — build the Docker image, tagged via `script/projectname`
-  (byte-identical across repos); same `--no-cache` and `VERSION` as
-  `script/cibuild`
+- `script/test` — `docker build --no-cache --target test -t prompts-test .`,
+  building the `test` phase of the `Dockerfile` (no tests defined here)
+- `script/lint` — `docker build --no-cache --target lint -t prompts-lint .`,
+  building the `lint` phase, which runs prettier over the markdown files
+- `script/fmt` — format all markdown files with prettier (writes; native, not in
+  a container)
+- `script/fmt-check` — check formatting (read-only; native)
+- `script/check` — run all checks: `test`, `lint`, `fmt-check`, then
+  `docker build -t prompts .` (our own extension; no `--no-cache` there, because
+  the two phases that build depends on were just built without it)
+- `script/docker` —
+  `docker build --no-cache --build-arg VERSION="$version" -t prompts .`, the tag
+  coming from `script/projectname` (byte-identical across repos)
 - `script/cibuild` — cd to the repo root, compute `version` from `git describe`,
-  then `docker build --no-cache --build-arg VERSION="$version" .` (what CI runs;
-  the image build runs `script/check`, `--no-cache` is what stops Docker serving
-  those checks from cache on an unchanged tree, and the version is computed on
-  the host because `.dockerignore` excludes `.git`)
+  run `script/check`, then
+  `docker build --build-arg VERSION="$version" -t prompts .` (what CI runs; the
+  version is computed on the host because `.dockerignore` excludes `.git`)
 - `script/precommit` — run by the git pre-commit hook (our own extension); calls
   `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own