Install lint-phase libraries with apt-get, not apk (closes #83)

The note under the canonical Go Dockerfile example said to install
system libraries for linting with `apk add`, but the lint phase is
based on the Debian golangci-lint image, which has no apk. It now
gives the apt-get command with the Debian package name (libvips-dev)
and removes the package lists in the same RUN. No other canonical
sentence describes installing a library in the lint phase; the
remaining apk mentions concern the alpine build stage or the host.
Nothing is pinned or unpinned.

Model: opus-5-5

TODO.md

@@ -21,6 +21,12 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-04: The note under the canonical Go `Dockerfile` example in
+  `REPO_POLICIES.md` now installs lint-phase system libraries with `apt-get`
+  under their Debian package names (issue 83). The `golangci/golangci-lint`
+  image is Debian-based and has no `apk`, so the old `apk add` instruction
+  failed as written. Nothing is pinned or unpinned; that is still open on
+  issue 72.
 - 2026-10-04: `REPO_POLICIES.md` now says how a Go tool a repo needs on the host
   is pinned (issue 37): installed with `go install` pinned to a commit hash,
   never tracked as a `go.mod` tool dependency or through a `tools.go` file.