Pin pipenv by hash and keep one form of the Python lockfile install (closes #133)

Rework of #135 on the review at
#135 (comment). A Python
test phase now has one form: COPY script/, COPY Pipfile Pipfile.lock,
RUN script/bootstrap, then ARG CACHEBUST, and every list of what goes
above the line names that step. In that step script/bootstrap installs
only system packages, pipenv and its dependencies by hash with pip
--require-hashes, and the lockfile's packages, and no Python. The claim
about a kept layer covers only what is pinned by hash and says its
system packages may be older. The bold rule is conditional, the
script/cibuild items expect the step to show CACHED, and the example
says why it installs make and git.

Model: opus-5-5

README.md

@@ -145,16 +145,16 @@ alpine. We provide:
 `make hooks` installs the pre-commit hook that runs `script/precommit`.
 
 In every stage of a `Dockerfile`, `ARG CACHEBUST` comes right after the steps
-that install system packages, download Go's modules or install a `test` phase's
-Python packages from `Pipfile.lock`, or right after `FROM` in a stage with none
-of these, and every step that lints, tests or compiles comes after it. The
-`script/` builds pass a new `CACHEBUST` value on every build, which reruns every
-`RUN` step after that line and leaves the layers above it and the cache mounts
-in place; `--no-cache` would build those layers again and empty the mounts. This
-repo's own `Dockerfile` declares `ARG CACHEBUST` right after `FROM` in every
-stage: each stage installs system packages and node packages together in one
-`script/bootstrap` step, and check builds may keep system packages but not node
-packages.
+that install system packages, download Go's modules or run `script/bootstrap` to
+install a Python `test` phase's packages from `Pipfile.lock`, or right after
+`FROM` in a stage with none of these, and every step that lints, tests or
+compiles comes after it. The `script/` builds pass a new `CACHEBUST` value on
+every build, which reruns every `RUN` step after that line and leaves the layers
+above it and the cache mounts in place; `--no-cache` would build those layers
+again and empty the mounts. This repo's own `Dockerfile` declares
+`ARG CACHEBUST` right after `FROM` in every stage: each stage installs system
+packages and node packages together in one `script/bootstrap` step, and check
+builds may keep system packages but not node packages.
 
 ## Rationale