WIP: re-vendor canonical files and gate phases

Model: opus-5-5

script/bootstrap

@@ -3,7 +3,8 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
-# make, or go).
+# make, or go). The linter and the tests run only in Docker, as phases of
+# the Dockerfile, so nothing installs golangci-lint here.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -58,11 +59,10 @@ main() {
     # Go toolchain
     if missing go; then pkg_install go golang go go; fi
 
-    # golangci-lint: packaged in nix, brew, and apk. There is no apt
-    # package; on apt systems install it manually from a hash-verified
-    # GitHub release archive (never curl | sh).
-    if missing golangci-lint; then
-        pkg_install golangci-lint golangci-lint golangci-lint golangci-lint
+    # Warn, don't fail: make build works without it.
+    if missing docker; then
+        echo "bootstrap: WARNING: docker not found; install it to run" \
+            "make test, make lint, make check and make docker." >&2
     fi
 
     go mod download