Adds a golangci-lint lint stage that runs make fmt-check and make lint,
and runs make test in the build stage, so the container build fails when
formatting, lint, or any test fails. The build stage waits for the lint
stage via COPY --from=lint /src/go.sum /dev/null.
Pins the base images by digest (golang:1.24-bookworm, debian:bookworm-slim)
and the new lint image (golangci/golangci-lint:v2.7.2, Go 1.25.5) with
version and date comments; versions are unchanged. The final image content
and entrypoint are unchanged.
Model: opus-4-8