build: define the lint stage name once so the two flags cannot diverge

The previous commit claimed --target and --no-cache-filter "validate each
other's magic string". They do not. --target validates only its own
argument; a typo confined to --no-cache-filter left the build green and
linting nothing:

    docker build --target lint --no-cache-filter=lnit ...
    #10 [lint 2/2] RUN golangci-lint run ... CACHED   exit 0

Three of the four edit paths were caught and one was not, so the original
false green survived in the narrow case.

The duplication was the defect: the stage name appeared twice on one
command line and nothing tied the copies together. Correcting only the
prose would have left the hazard live and merely warned about, so the name
is now written once, as `stage=lint`, and passed to both flags. Divergence
is unrepresentable rather than documented — there is a single name to get
wrong, and --target rejects it loudly when it is not a stage in
Dockerfile.lint, which now covers the filter too because it is the same
string.

The comments in script/lint and Dockerfile.lint and the TODO.md entry drop
the false "validate each other" claim and state the real property, along
with the residual hazard that is genuinely unguarded: --target checks that
the name exists, not that it names the stage which actually runs
golangci-lint, and it stops the build there, so relocating the lint step
or appending a stage after it would go unnoticed.

TODO.md

@@ -66,16 +66,30 @@ is finished.
     from cache; wall-clock durations vary per host and per run, so they are not
     recorded here.
 
-    Hardened 2026-08-10 after review. `script/lint` now also passes
-    `--target lint` and `--output=type=cacheonly`. `--target` is what makes
-    `--no-cache-filter=lint` trustworthy: BuildKit silently ignores the filter
-    when no stage matches the name, so a rename or typo of the `lint` stage
-    would have left the lint layer cached and `script/lint` green having linted
-    nothing — the same false green in a new place. `--target` fails loudly on a
-    name that does not exist, so the two flags validate each other and must be
-    kept in sync. `--output=type=cacheonly` skips the image export: nothing
-    consumes the image (the deliverable is an exit code), and exporting it cost
-    seconds per run and left a dangling image behind each time.
+    Hardened 2026-08-10 after review. `script/lint` now also passes `--target`
+    and `--output=type=cacheonly`. `--target` is what makes `--no-cache-filter`
+    trustworthy: BuildKit silently ignores the filter when no stage matches its
+    argument, so a rename or typo of the `lint` stage would have left the lint
+    layer cached and `script/lint` green having linted nothing — the same false
+    green in a new place. `--target` fails loudly on a name that is not in the
+    file. `--output=type=cacheonly` skips the image export: nothing consumes the
+    image (the deliverable is an exit code), and exporting it cost seconds per
+    run and left a dangling image behind each time.
+
+    Corrected 2026-08-10 after a second review, which was right to reject the
+    claim first made here that the two flags "validate each other". They did
+    not: `--target` validates only its own argument, so a typo confined to
+    `--no-cache-filter` still built `CACHED` at exit 0 — the original defect,
+    surviving in the narrow case. The duplicated stage name was the defect, so
+    it is now written once, as `stage=lint` in `script/lint`, and passed to both
+    flags. The true property is that there is only one name to get wrong, and
+    `--target` rejects it loudly if it is not a stage in `Dockerfile.lint`, so a
+    typo or a stale rename is a hard error rather than a silent skip. What
+    remains on the editor, and is not checked by anything: `$stage` must name
+    the stage that actually runs `golangci-lint`. `--target` verifies the name
+    exists, not that it is the right stage, and it stops the build there — so
+    moving the lint step to another stage, or adding a stage after it, would go
+    unnoticed.
 
 - 2026-08-09 `TestAutoSaveOnSignalRacesTurnLoop` de-flaked at the cause
   (`fix/autosave-turn-budget-36`, closes #36). The failure text was captured