Gate the build on Docker lint and test phases (closes #40, closes #30)

Per the owner ruling on issue 40, linting and testing are phases of the
main Dockerfile rather than a separate lint file. script/lint and
script/test build one phase each by name with caching disabled, and the
final stage copies a harmless file from each so the image cannot be built
unless both passed. A stage that is not the last is built only when
something depends on it or --target names it, so the gates are invoked by
name and the edges kept. script/check runs the gates and builds no image
of its own; script/cibuild bootstraps first, because CI runs it alone and
fmt-check is native. fmt and fmt-check source nvm for the pinned node
before calling yarn, which bootstrap installs but leaves off its caller's
PATH. Every build in script/ is tagged and uncached. Issue 30 closes too:
a container has its own lint cache and lock.

Model: opus-5

prompts/CODE_STYLEGUIDE_GO.md

@@ -105,14 +105,18 @@ last_modified: 2026-09-08
 
 1.  For anything beyond a simple script or tool, or anything that is going to
     run in any sort of "production" anywhere, make sure it passes
-    `golangci-lint`.
+    `golangci-lint`. Run it with `make lint`, never by invoking the binary: the
+    linter runs as a phase of the `Dockerfile` and is not installed on the host
+    by any repo. Invoked directly on a shared host it reads a result cache keyed
+    on file content rather than location, and a host-global lock, so its answer
+    may belong to another checkout entirely.
 
 1.  Write a `Dockerfile` for every repo, even if it only runs the tests and
-    linting. `script/cibuild` and `script/docker` should always make sure that
-    the code is in an able-to-be-compiled state, linted, and any tests run, and
-    the build should fail if linting doesn't pass. Go through those scripts
+    linting. It carries the lint and test phases, and the final stage depends on
+    both, so a build makes sure the code is in an able-to-be-compiled state,
+    linted, and its tests run. Go through `script/cibuild` or `script/docker`
     rather than a bare `docker build .`: they pass `--no-cache`, without which
-    an unchanged tree serves the check layers from cache and the build reports a
+    an unchanged tree serves the gate layers from cache and the build reports a
     green it never ran.
 
 1.  Every repo must have a `Makefile`. See