Make lint and test phases of the Dockerfile (closes #96)

Follows the template: Dockerfile.lint is gone; the Dockerfile has a lint
phase (eslint, prettier --check .) and a test phase (vitest, run as the
node user, which the not-writable-directory tests need), and its
last stage compiles and depends on both. script/lint and script/test
build one phase each with --no-cache; script/docker and script/cibuild
pass --no-cache, so CHECK_EPOCH and LINT_EPOCH are removed.
script/cibuild is the single image build, so CI runs lint and the tests
once each. The tests that checked the old layout are deleted,
REPO_POLICIES.md is re-copied and the README describes the new layout.

Model: opus-5-5

test/packaging/entrypoints.test.ts

@@ -1,9 +1,7 @@
 // The package manifest promises three files that only exist after a build:
 // `main`, `types`, and the `quak` binary. Nothing in the test suite used to
-// look at them, and `make check` runs the suite and the lint container but
-// never the build, so `tsconfig.json` and `package.json` were free to drift
-// apart. (The formatting check is part of the lint container, not a step of
-// its own; `test/packaging/lint-once.test.ts` is what holds that shape.) They
+// look at them, and `make check` runs the test and lint phases but never the
+// build, so `tsconfig.json` and `package.json` were free to drift apart. They
 // did: `rootDir` was `./src` while `include` also pulled in `bin/**/*`, which
 // is TS6059, and no build had succeeded for as long as that was true.
 //