Keep Go's build cache in check builds (closes #113)

script/lint, script/test, script/cibuild and script/docker pass a new
CACHEBUST build argument on every build in place of --no-cache, which
empties every cache mount. Every Dockerfile stage declares ARG
CACHEBUST first, so every RUN step still runs on every check build.
The canonical Go Dockerfile mounts Go's build cache on the steps that
compile and runs both go test runs with -count=1, so no test result is
reused. REPO_POLICIES.md, both checklists, the Go styleguide and the
README say so. A stage without the ARG line is served from cache, so a
repository re-vendors the scripts and the ARG lines in one commit.

Model: opus-5-5

Dockerfile

@@ -2,8 +2,12 @@
 # lint` or `script/lint`, which are themselves a docker build and would
 # recurse into a daemon that does not exist in a build step.
 #
+# Every stage declares ARG CACHEBUST first: script/ passes a new value on
+# every build, which reruns every RUN step after it.
+#
 # node 22-alpine, 2026-02-22
 FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34 AS lint
+ARG CACHEBUST
 
 WORKDIR /app
 
@@ -19,6 +23,7 @@ RUN yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
 #
 # node 22-alpine, 2026-02-22
 FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34 AS test
+ARG CACHEBUST
 
 WORKDIR /app
 
@@ -38,6 +43,7 @@ RUN echo "No tests defined."
 #
 # node 22-alpine, 2026-02-22
 FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34
+ARG CACHEBUST
 
 WORKDIR /app