test(lint-once): pin the two-build and later-flag shapes

The false green: script/lint chaining a second docker build after the
lint image ran prettier twice and counted once. The misresolution: a
bare docker build followed by cp -f resolved to the cp's file. Pin
both, and each separator that bounds an invocation.

README.md

@@ -129,13 +129,14 @@ invocation graph, so a second pass cannot creep back in unnoticed.
 `script/fmt-check` remains as a standalone entrypoint for asking the formatting
 question on its own, without docker and without the rest of lint. It is not the
 last formatting path on the host — `script/fmt` writes with the host prettier,
-and `package.json` exposes `fmt` and `fmt-check` as direct prettier calls — it is
-the one of them that the check graph could plausibly have reached, and nothing
-reaches it: neither `script/check` nor `script/precommit` calls it, so it never
-contributes to their verdicts. Its own verdict cannot drift from the container's: prettier is pinned
-to an exact version, installed from `yarn.lock` under `--frozen-lockfile` in
-both places, and reads `.gitignore` as its default ignore file — which is why
-`.dockerignore` deliberately keeps `.gitignore` in the build context.
+and `package.json` exposes `fmt` and `fmt-check` as direct prettier calls — it
+is the one of them that the check graph could plausibly have reached, and
+nothing reaches it: neither `script/check` nor `script/precommit` calls it, so
+it never contributes to their verdicts. Its own verdict cannot drift from the
+container's: prettier is pinned to an exact version, installed from `yarn.lock`
+under `--frozen-lockfile` in both places, and reads `.gitignore` as its default
+ignore file — which is why `.dockerignore` deliberately keeps `.gitignore` in
+the build context.
 
 Lint happens in exactly one place in that graph, which constrains the rest of
 the build. `script/check` calls `script/lint`, so `make check` cannot run inside