Install lint-phase libraries with apt-get, not apk (closes #83)

The note under the canonical Go Dockerfile example said to install
system libraries for linting with `apk add`, but the lint phase is
based on the Debian golangci-lint image, which has no apk. It now
gives the apt-get command with the Debian package name (libvips-dev)
and removes the package lists in the same RUN. No other canonical
sentence describes installing a library in the lint phase; the
remaining apk mentions concern the alpine build stage or the host.
Nothing is pinned or unpinned.

Model: opus-5-5

TODO.md

@@ -21,6 +21,12 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-04: The note under the canonical Go `Dockerfile` example in
+  `REPO_POLICIES.md` now installs lint-phase system libraries with `apt-get`
+  under their Debian package names (issue 83). The `golangci/golangci-lint`
+  image is Debian-based and has no `apk`, so the old `apk add` instruction
+  failed as written. Nothing is pinned or unpinned; that is still open on
+  issue 72.
 - 2026-10-04: `REPO_POLICIES.md` now says how a Go tool a repo needs on the host
   is pinned (issue 37): installed with `go install` pinned to a commit hash,
   never tracked as a `go.mod` tool dependency or through a `tools.go` file.

prompts/REPO_POLICIES.md

@@ -236,8 +236,18 @@ style conventions are in separate documents:
       (e.g. a web frontend compiled in a separate stage), the lint phase must
       create placeholder files so the embed directives resolve. Example:
       `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-    - If the project requires CGO or system libraries for linting (e.g.
+    - If the project requires CGO or system libraries for linting, install them
-      `vips-dev`), install them in the lint phase with `apk add`.
+      in the lint phase. The `golangci/golangci-lint` image is Debian-based and
+      has no `apk`, so install with `apt-get` under the Debian package name
+      (`libvips-dev`, where alpine says `vips-dev`), and delete the package
+      lists in the same `RUN`, so the layer does not keep them:
+
+        ```dockerfile
+        RUN apt-get update \
+            && apt-get install -y --no-install-recommends libvips-dev \
+            && rm -rf /var/lib/apt/lists/*
+        ```
+
     - `.dockerignore` lets `.git` into the build context. It keeps out
       `.git/config` and each submodule's `config` under `.git/modules/` at any
       depth (`.git/modules/**/config`), which `git describe` does not need and