Adopt scripts-to-rule-them-all: script/ entrypoints, Makefile shims

script/cibuild

@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/cibuild: run the CI build. The Dockerfile runs script/check
+# (via make check), so a successful build implies all checks pass.
+# The Gitea workflow runs this on push. The memlock ulimit is required
+# because the test suite uses memguard, which mlocks memory.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build --ulimit memlock=-1:-1 .
+}
+
+main "$@"