Stop script/lint writing an image it never uses (closes #48)

script/lint builds Dockerfile.lint only for the exit status, but every
run exported the result as an image: seconds spent exporting, and one
untagged image left behind each time. It now builds with
--output=type=cacheonly, so nothing is exported. CHECK_EPOCH still
changes on every run, so the gate steps still run each time; the build
cache is kept as before.

Model: opus-5-5

README.md

@@ -831,7 +831,9 @@ and may be invoked directly. The provided entrypoints are:
     copies the repository into the digest-pinned
     `golangci/golangci-lint` image and runs
     `golangci-lint config verify` and `golangci-lint run` as build
-    steps, so a successful build is a clean lint. The linter is never
+    steps, so a successful build is a clean lint. That exit status is
+    all it produces, so it runs with `--output=type=cacheonly` and
+    writes no image; a run leaves only build cache. The linter is never
     run on the host, which makes a working `docker` the one
     prerequisite for linting — and therefore for `make check` and the
     pre-commit hook. Offline machines: the gate steps themselves make