docs: trim the lint-gate comments to the traps (closes #44)

Comments and documentation only; the docker build invocation and its three
flags are byte-identical and .dockerignore's effective rules are unchanged.

script/lint and Dockerfile.lint stated how the shape was derived — why two
stages, why `golangci-lint config verify` was omitted, what earlier drafts
of the comments claimed. That is in the history. What survives is the three
traps, each of which yields a green run over an unlinted or partly linted
tree: --target and --no-cache-filter must both stay with $stage matching the
stage name in Dockerfile.lint; --target checks that the stage exists, not
that it runs golangci-lint, and halts the build there; and .dockerignore
decides what reaches the container, so excluding a self-contained Go file
drops it from the lint silently.

The TODO.md entry loses its "Hardened" and "Corrected" paragraphs, which
argued with earlier versions of themselves, and keeps the flags, the durable
property, the three unguarded seams, and the evidence that the gate was
verified rather than assumed.

.dockerignore

@@ -1,9 +1,4 @@
-# The lint build reads the Go sources, go.mod/go.sum and .golangci.yml;
-# none of that comes out of .git, so keep the build context small.
-#
-# This file is part of the lint gate, not housekeeping: only what reaches
-# the container gets linted, so excluding a Go source here silently drops
-# it from the lint (a self-contained file yields `0 issues.` at exit 0 with
-# the violation still in the tree; it fails loudly only if other code still
-# references it). Never exclude Go sources, go.mod/go.sum or .golangci.yml.
+# Part of the lint gate: only what reaches the container is linted, so
+# excluding a self-contained Go source here drops it from the lint silently.
+# Never exclude Go sources, go.mod/go.sum or .golangci.yml.
 .git