Make lint and test phases of the Dockerfile (closes #96)

Follows the template: Dockerfile.lint is gone; the Dockerfile has a lint
phase (eslint, prettier --check .) and a test phase (vitest, run as the
node user, which the not-writable-directory tests need), and its
last stage compiles and depends on both. script/lint and script/test
build one phase each with --no-cache; script/docker and script/cibuild
pass --no-cache, so CHECK_EPOCH and LINT_EPOCH are removed.
script/cibuild is the single image build, so CI runs lint and the tests
once each. The tests that checked the old layout are deleted,
REPO_POLICIES.md is re-copied and the README describes the new layout.

Model: opus-5-5

test/packaging/build-context.test.ts

@@ -2,13 +2,13 @@
 // failures are silent.
 //
 // Excluding too little: a worktree left under `.claude/` is copied into the
-// image, vitest globs its `test/` tree as well as the real one, and the
-// containerised `make check` runs the whole suite twice over while reporting
-// success. A compiled `bin/quak` is ~100 MB of context nobody needs.
+// image, vitest globs its `test/` tree as well as the real one, and the test
+// phase runs the whole suite twice over while reporting success. A compiled
+// `bin/quak` is ~100 MB of context nobody needs.
 //
 // Excluding too much: Prettier 3 reads `.gitignore` as a default ignore file,
-// so dropping it from the context silently changes which files
-// `make fmt-check` looks at inside the image compared to the host.
+// so dropping it from the context silently changes which files the lint
+// phase's prettier check looks at compared to `make fmt-check` on the host.
 //
 // Neither shows up as a build failure, so they are asserted here.
 import { describe, expect, it } from "vitest";
@@ -47,18 +47,13 @@ describe(".dockerignore", () => {
         expect(dockerignore).not.toContain(".gitignore");
     });
 
-    // Both images are built from this same context, and the lint image runs
-    // eslint and prettier across it. BuildKit lets a `<dockerfile>.dockerignore`
-    // shadow the root one for a single build; such a file would silently give
-    // the lint build a different, unreviewed context — and eslint's flat config
-    // does not ignore dot-directories, so a stray `.claude/` worktree would be
-    // linted.
-    it.each(["Dockerfile", "Dockerfile.lint"])(
-        "is not shadowed by a per-Dockerfile ignore file for %s",
-        (name) => {
-            expect(existsSync(join(repoRoot, `${name}.dockerignore`))).toBe(
-                false,
-            );
-        },
-    );
+    // BuildKit lets a `Dockerfile.dockerignore` shadow the root one; such a
+    // file would silently give the build a different, unreviewed context —
+    // and eslint's flat config does not ignore dot-directories, so a stray
+    // `.claude/` worktree would be linted.
+    it("is not shadowed by a Dockerfile.dockerignore", () => {
+        expect(existsSync(join(repoRoot, "Dockerfile.dockerignore"))).toBe(
+            false,
+        );
+    });
 });