Adopt scripts-to-rule-them-all: script/ entrypoints, Makefile shims, policy update

script/cibuild

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# script/cibuild: run the CI build. The Dockerfile runs script/check, so
+# a successful build implies all checks pass.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build .
+}
+
+main "$@"