Keep Go's build cache in check builds (closes #113)

The script/ builds pass a new CACHEBUST build argument on every run in
place of --no-cache, which also emptied Go's build cache mount. Every
Dockerfile stage declares ARG CACHEBUST first, so every RUN step still
reruns on an unchanged tree. The canonical Go Dockerfile mounts only
Go's build cache, on the steps that compile, so compiled packages
survive between check builds; both go test runs carry -count=1, so no
test result is reused. golangci-lint's own cache and the module cache
are not kept.

A repository re-vendors the scripts and adds the ARG lines in one
commit: a stage without the line is served from cache with no warning.

Unverified: not yet tried on the shared CI runner.

Model: opus-5-5

TODO.md

@@ -21,6 +21,16 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-15: Check builds now keep Go's build cache between runs (issue 113),
+  on sneak's ruling there that Go's compile cache may survive. `script/lint`,
+  `script/test`, `script/cibuild` and `script/docker` pass a new `CACHEBUST`
+  build argument on every build in place of `--no-cache`, which also emptied the
+  cache mounts. Every `Dockerfile` stage declares `ARG CACHEBUST` first, so
+  every `RUN` step still runs on every check build. The canonical Go
+  `Dockerfile` mounts Go's build cache on the steps that compile and runs both
+  `go test` runs with `-count=1`, so no test result is reused. A stage without
+  the `ARG` line is served from cache, so repositories re-vendor the scripts and
+  the `ARG` lines in one commit. Not yet tried on the shared runner.
 - 2026-10-08: The canonical `script/bootstrap` now uses the installed node only
   when its major version is the pinned one (issue 118). Otherwise, as when node
   is missing, it installs the pinned node under nvm and installs yarn and the