The rule put repo-type-specific extras such as `go mod tidy`
verification in `script/precommit`. `script/precommit` is one caller of
`script/check`, not the gate: a check placed there alone runs only for
contributors who installed the hook, and never in CI. Naming
`script/check` instead puts the check on every path that already funnels
through it, including the Dockerfile build step and therefore CI, with
the pre-commit hook inheriting it.
Records the read-only constraint that placement implies, since
`make check` must not modify files.
