Make lint and test phases of the Dockerfile (closes #96)

Follows the template: Dockerfile.lint is gone; the Dockerfile has a lint
phase (eslint, prettier --check .) and a test phase (vitest, run as the
node user, which the not-writable-directory tests need), and its
last stage compiles and depends on both. script/lint and script/test
build one phase each with --no-cache; script/docker and script/cibuild
pass --no-cache, so CHECK_EPOCH and LINT_EPOCH are removed.
script/cibuild is the single image build, so CI runs lint and the tests
once each. The tests that checked the old layout are deleted,
REPO_POLICIES.md is re-copied and the README describes the new layout.

Model: opus-5-5

script/test

@@ -1,25 +1,19 @@
 #!/bin/sh
-# script/test: run the test suite. Uses `timeout` (GNU coreutils) when
-# available so the run is hard-capped at 30s; on macOS without
-# coreutils the cap is skipped.
+# script/test: run the test suite. Testing is a phase of the Dockerfile
+# and this builds that phase alone, on the same terms as script/lint:
+# --target because a phase that is not the last stage is built only when
+# named, --no-cache because a cached test layer is a test that did not
+# run, and a tag so each build replaces the previous image.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-rerun_verbose() {
-    echo "--- Rerunning with verbose for details ---"
-    yarn run vitest run --reporter=verbose
-    exit 1
-}
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    TIMEOUT="$(command -v timeout 2>/dev/null || command -v gtimeout 2>/dev/null || true)"
-    if [ -n "$TIMEOUT" ]; then
-        "$TIMEOUT" 30s yarn run vitest run --reporter=dot || rerun_verbose
-    else
-        yarn run vitest run --reporter=dot || rerun_verbose
-    fi
+    docker build --no-cache \
+        --target test \
+        -t "$("$SCRIPT_DIR/projectname")-test" .
 }
 
 main "$@"