Keep Go's build cache between builds (closes #124)

The Dockerfile runs make test and make build with Go's build cache in a
BuildKit cache mount, so a build compiles only what changed since the
last one instead of the standard library and every dependency from
nothing. The mount has an id of its own, so builds of other repositories,
compiled against other C headers, do not share it. script/test passes
-count=1, so no test result is taken from the cache.

Model: opus-5-5

TODO.md

@@ -18,6 +18,16 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-06: `make test` in `script/cibuild` no longer compiles the standard
+  library and every dependency from nothing on every build
+  (https://git.eeqj.de/sneak/secret/issues/124). The `Dockerfile` runs it and
+  `make build` with Go's build cache in a BuildKit cache mount, which docker
+  keeps between builds, locally and on the Gitea runner alike, so each compiles
+  only what changed since the last build. The mount has an id of its own, so
+  other repositories' builds do not share it. `script/test` passes `-count=1`,
+  so every test runs on every build and no result comes from Go's test cache. A
+  build with an empty cache, such as the first after docker's build cache is
+  cleared, compiles everything in `make test` as before.
 - 2026-10-06: The tests run quickly with the race detector on
   (https://git.eeqj.de/sneak/secret/issues/120). Most of their time went to
   deriving keys from passphrases with scrypt, which is slow on purpose. The new