Keep Go's build cache in check builds (closes #113)

script/lint, script/test, script/cibuild and script/docker pass a new
CACHEBUST build argument on every build in place of --no-cache, which
empties every cache mount. Every Dockerfile stage declares ARG
CACHEBUST first, so every RUN step still runs on every check build.
The canonical Go Dockerfile mounts Go's build cache on the steps that
compile and runs both go test runs with -count=1, so no test result is
reused. REPO_POLICIES.md, both checklists, the Go styleguide and the
README say so. A stage without the ARG line is served from cache, so a
repository re-vendors the scripts and the ARG lines in one commit.

Model: opus-5-5

script/test

@@ -2,8 +2,9 @@
 # script/test: run the test suite. Testing is a phase of the Dockerfile
 # and this builds that phase alone, on the same terms as script/lint:
 # --target because a phase that is not the last stage is built only when
-# named, and --no-cache because a cached test layer is a test that did
-# not run. --output type=cacheonly writes no image, since nothing uses one.
+# named, and a new CACHEBUST value because a cached test layer is a test
+# that did not run; unlike --no-cache, it keeps Go's build cache.
+# --output type=cacheonly writes no image, since nothing uses one.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -11,7 +12,7 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build --no-cache \
+    docker build --build-arg CACHEBUST="$(date +%s)-$$" \
         --target test \
         --output type=cacheonly .
 }