docs: name the two required flags, and record .dockerignore as part of the gate

Comments and documentation only; the docker build invocation and its flags
are untouched, and .dockerignore's effective rules are unchanged.

Two prose gaps from review. First, "both flags below must stay" had lost
its anchor: it ended a paragraph naming only --no-cache-filter, --target
was not introduced until the next one, and three flags follow on the
command, so a reader could pick the wrong pair. It now names --target and
--no-cache-filter explicitly.

Second, the list of things the tooling does not check covered the $stage
seam but not .dockerignore, which sits in the same trust boundary and is
the more likely thing to be edited — the first review on this change
actively suggested extending it for build artifacts. Only what reaches the
container is linted, so excluding a Go source there removes it from the
lint with no warning. Verified rather than asserted: a planted violation
plus that one path in .dockerignore yields `0 issues.` at exit 0 with the
violation still in the working tree, while excluding a file other code
still references fails loudly on `undefined:` typecheck errors instead.
The warning is recorded in script/lint alongside the $stage seam and in
.dockerignore itself, where the edit would actually be made.

TODO.md

@@ -89,7 +89,12 @@ is finished.
     the stage that actually runs `golangci-lint`. `--target` verifies the name
     exists, not that it is the right stage, and it stops the build there — so
     moving the lint step to another stage, or adding a stage after it, would go
-    unnoticed.
+    unnoticed. The same applies to `.dockerignore`, which is part of this gate
+    rather than housekeeping: only what reaches the container is linted, so
+    excluding a Go source there drops it from the lint silently — verified, a
+    planted violation plus that one path in `.dockerignore` gives `0 issues.` at
+    exit 0 with the violation still in the tree, and it fails loudly only when
+    other code still references the excluded file.
 
 - 2026-08-09 `TestAutoSaveOnSignalRacesTurnLoop` de-flaked at the cause
   (`fix/autosave-turn-budget-36`, closes #36). The failure text was captured