Make lint and test phases of the Dockerfile (closes #96)

Follows the template: Dockerfile.lint is gone; the Dockerfile has a lint
phase (eslint, prettier --check .) and a test phase (vitest, run as the
node user, which the not-writable-directory tests need), and its
last stage compiles and depends on both. script/lint and script/test
build one phase each with --no-cache; script/docker and script/cibuild
pass --no-cache, so CHECK_EPOCH and LINT_EPOCH are removed.
script/cibuild is the single image build, so CI runs lint and the tests
once each. The tests that checked the old layout are deleted,
REPO_POLICIES.md is re-copied and the README describes the new layout.

Model: opus-5-5

script/lint

@@ -1,24 +1,23 @@
 #!/bin/sh
-# script/lint: run the linters. eslint and prettier are never run against
-# the working tree from here: linting runs via docker only, one way,
-# everywhere — script/lint builds Dockerfile.lint, which COPYs the repo into
-# the pinned node image and runs the linters as build steps. That works even
-# when the docker daemon is remote and bind mounts are impossible.
+# script/lint: run the linter. Linting is a phase of the Dockerfile and
+# this builds that phase alone; the linter is never installed or run on
+# a developer host, where a shared result cache and a host-global lock
+# make its answer untrustworthy.
 #
-# LINT_EPOCH is passed on every invocation because no lint cache is wanted:
-# on an unchanged tree Docker would otherwise serve the linter layers, having
-# linted nothing, and still exit 0. Dockerfile.lint refuses to build without
-# the argument, so no path to a lint result can quietly come from cache.
-#
-# Nothing that runs inside a container may call this script; see the header
-# of Dockerfile.
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. --no-cache because a cached lint layer is a lint
+# that did not run. The tag makes each build replace the previous image
+# instead of leaving a dangling one behind.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build --build-arg LINT_EPOCH="$(date +%s)" -f Dockerfile.lint .
+    docker build --no-cache \
+        --target lint \
+        -t "$("$SCRIPT_DIR/projectname")-lint" .
 }
 
 main "$@"