Make lint and test phases of the Dockerfile (closes #96)

Follows the template: Dockerfile.lint is gone; the Dockerfile has a lint
phase (eslint, prettier --check .) and a test phase (vitest, run as the
node user so the not-writable-directory tests are not skipped), and its
last stage compiles and depends on both. script/lint and script/test
build one phase each with --no-cache; script/docker and script/cibuild
pass --no-cache, so CHECK_EPOCH and LINT_EPOCH are removed.
script/cibuild is the single image build, so CI runs lint and the tests
once each. The tests that checked the old layout are deleted,
REPO_POLICIES.md is re-copied and the README describes the new layout.

Model: opus-5-5

test/download/download.test.ts

@@ -223,7 +223,8 @@ afterAll(() => {
  * `sodium.randombytes_buf` goes through the wasm wrapper a byte at a time and
  * costs roughly 20 seconds for the 4 MiB chunk below — about two hundred
  * times what it costs to encrypt the same buffer, and on its own enough to
- * push `make test` past the 30-second cap in `script/test`. This loop fills
+ * push `make test` past the 90-second `timeout` in the `test` phase of the
+ * `Dockerfile`. This loop fills
  * 4 MiB in a few milliseconds.
  */
 const patternBytes = (length: number, seed: number): Uint8Array => {
@@ -1009,8 +1010,9 @@ describe.each(entryPoints)(
             expect(readdirSync(dir)).toEqual([]);
         });
 
-        // Root ignores directory permissions, so this cannot fail as root
-        // (the Docker test image runs as root).
+        // Root ignores directory permissions, so this cannot fail as root.
+        // The `test` phase of the `Dockerfile` runs as the `node` user so
+        // that `make check` runs it.
         it.skipIf(process.getuid?.() === 0)(
             "fails without creating anything when the destination directory is not writable",
             async () => {