Keep Go's build cache in check builds (closes #113)

script/lint, script/test, script/cibuild and script/docker pass a new
CACHEBUST build argument on every build in place of --no-cache, which
empties every cache mount. Every Dockerfile stage declares ARG
CACHEBUST first, so every RUN step still runs on every check build.
The canonical Go Dockerfile mounts Go's build cache on the steps that
compile and runs both go test runs with -count=1, so no test result is
reused. REPO_POLICIES.md, both checklists, the Go styleguide and the
README say so. A stage without the ARG line is served from cache, so a
repository re-vendors the scripts and the ARG lines in one commit.

Model: opus-5-5

README.md

@@ -117,25 +117,25 @@ alpine. We provide:
 - `script/projectname` — output the project name (our own extension); used by
   `script/docker` for the image tag
 - `script/test` —
-  `docker build --no-cache --target test --output type=cacheonly .`, building
-  the `test` phase of the `Dockerfile` without writing an image (no tests
-  defined here)
+  `docker build --build-arg CACHEBUST="$(date +%s)-$$" --target test --output type=cacheonly .`,
+  building the `test` phase of the `Dockerfile` without writing an image (no
+  tests defined here)
 - `script/lint` —
-  `docker build --no-cache --target lint --output type=cacheonly .`, building
-  the `lint` phase, which runs prettier over the markdown files, without writing
-  an image
+  `docker build --build-arg CACHEBUST="$(date +%s)-$$" --target lint --output type=cacheonly .`,
+  building the `lint` phase, which runs prettier over the markdown files,
+  without writing an image
 - `script/fmt` — format all markdown files with prettier (writes; native, not in
   a container)
 - `script/fmt-check` — check formatting (read-only; native)
 - `script/check` — run all checks: `test`, `lint`, `fmt-check` (our own
   extension); builds no image of its own
 - `script/docker` —
-  `docker build --no-cache --build-arg VERSION="$version" -t prompts .`, the tag
-  coming from `script/projectname` (byte-identical across repos)
+  `docker build --build-arg CACHEBUST="$(date +%s)-$$" --build-arg VERSION="$version" -t prompts .`,
+  the tag coming from `script/projectname` (byte-identical across repos)
 - `script/cibuild` — cd to the repo root, run `script/bootstrap`, run
   `script/check`, compute `version` from `git describe`, then
-  `docker build --no-cache --build-arg VERSION="$version" -t prompts .` (what CI
-  runs; it bootstraps because CI checks out and runs this alone while
+  `docker build --build-arg CACHEBUST="$(date +%s)-$$" --build-arg VERSION="$version" -t prompts .`
+  (what CI runs; it bootstraps because CI checks out and runs this alone while
   `script/fmt-check` is native)
 - `script/precommit` — run by the git pre-commit hook (our own extension); calls
   `script/check`
@@ -144,6 +144,10 @@ alpine. We provide:
 
 `make hooks` installs the pre-commit hook that runs `script/precommit`.
 
+Every stage of the `Dockerfile` declares `ARG CACHEBUST` as its first line after
+`FROM`. The `script/` builds pass a new `CACHEBUST` value on every build, which
+reruns every `RUN` step and keeps Go's build cache; `--no-cache` would empty it.
+
 ## Rationale
 
 LLM prompts, especially development policies, benefit from version control and a