Make lint and test phases of the Dockerfile (closes #96)

Follows the template: Dockerfile.lint is gone; the Dockerfile has a lint
phase (eslint, prettier --check .) and a test phase (vitest, run as the
node user, which the not-writable-directory tests need), and its
last stage compiles and depends on both. script/lint and script/test
build one phase each with --no-cache; script/docker and script/cibuild
pass --no-cache, so CHECK_EPOCH and LINT_EPOCH are removed.
script/cibuild is the single image build, so CI runs lint and the tests
once each. The tests that checked the old layout are deleted,
REPO_POLICIES.md is re-copied and the README describes the new layout.

Model: opus-5-5

script/precommit

@@ -4,17 +4,9 @@
 #
 # Runs lint but deliberately NOT the tests, so the TDD red-phase commit
 # (failing tests, no implementation yet) can land. CI runs
-# script/cibuild, which builds both images and so catches any branch
-# that ships red.
-#
-# The formatting check is still enforced here, because script/lint is a
-# build of Dockerfile.lint and that runs `prettier --check .` as a build
-# step: a badly formatted tree fails this hook, and therefore the
-# commit. Calling script/fmt-check as well would only run prettier a
-# second time over the same tree for the same verdict.
-#
-# script/lint is a docker build (Dockerfile.lint); docker is required to
-# commit, which is the point of linting one way, everywhere.
+# script/cibuild, whose image build includes the test phase, and so
+# catches any branch that ships red. The lint phase includes the
+# prettier check, so a badly formatted tree still fails the commit.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"