Keep Go's build cache between builds (closes #124)

make test and make build in the Dockerfile now share one Go build cache,
kept in a BuildKit cache mount with this repository's own id, so they
compile only what changed. script/test passes -count=1.

Model: opus-5-5

Dockerfile

@@ -50,7 +50,12 @@ ARG CHECK_EPOCH
 
 COPY . .
 
-RUN make test
+# This cache mount keeps Go's build cache between builds for make test and
+# make build; -count=1 in script/test keeps test results out of it. Go's cache
+# does not notice C header changes, so the mount has its own id: change the id
+# when the C packages installed above change.
+RUN --mount=type=cache,id=sneak/secret/go-build,target=/root/.cache/go-build \
+    make test
 
 # The version stamped into the binary: the VERSION build argument when one
 # is given, otherwise `git describe --tags --always` of the .git the build
@@ -58,7 +63,8 @@ RUN make test
 # one, the short commit when no tag is reachable. A context that carries .git
 # and still yields no version fails the build.
 ARG VERSION
-RUN version="${VERSION:-$(git describe --tags --always)}"; \
+RUN --mount=type=cache,id=sneak/secret/go-build,target=/root/.cache/go-build \
+    version="${VERSION:-$(git describe --tags --always)}"; \
     if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
         [ "$version" = unknown ]; }; then \
         echo "no version could be derived although the build context carries .git" >&2; \