Keep modules, lint cache and system packages in check builds (closes #130)

On sneak's ruling in #130, check
builds may keep three more things besides Go's build cache. In each stage
of the canonical Go Dockerfile, the system-package install and the module
download now come before ARG CACHEBUST, so Docker keeps those layers until
the base image, the install line, go.mod or go.sum changes. The modules
are kept as a layer, not a cache mount, because Go does not check a cache
mount's files again. golangci-lint run also mounts golangci-lint's cache.
Every step that lints, tests or compiles still comes after ARG CACHEBUST
and reruns on every check build, and both go test runs keep -count=1. The
policy, both checklists, the Go style guide, the README and the script
comments state the rule the same way.

Model: opus-5-5

README.md

@@ -144,9 +144,16 @@ alpine. We provide:
 
 `make hooks` installs the pre-commit hook that runs `script/precommit`.
 
-Every stage of the `Dockerfile` declares `ARG CACHEBUST` as its first line after
-`FROM`. The `script/` builds pass a new `CACHEBUST` value on every build, which
-reruns every `RUN` step and keeps Go's build cache; `--no-cache` would empty it.
+In every stage of a `Dockerfile`, `ARG CACHEBUST` comes right after the steps
+that install system packages and download Go's modules, or right after `FROM` in
+a stage with neither, and every step that lints, tests or compiles comes after
+it. The `script/` builds pass a new `CACHEBUST` value on every build, which
+reruns every `RUN` step after that line and leaves the layers above it and the
+cache mounts in place; `--no-cache` would build those layers again and empty the
+mounts. This repo's own `Dockerfile` declares `ARG CACHEBUST` right after `FROM`
+in every stage: each stage installs system packages and node packages together
+in one `script/bootstrap` step, and check builds may keep system packages but
+not node packages.
 
 ## Rationale