Keep the module cache out of the build stage's chown (closes #43)

The build stage handed /src and the whole Go module cache to the
unprivileged user with chown -R, in a layer that re-ran on every source
change. On this host that step took minutes and lately stalled
script/cibuild outright.

The module cache now sits at /go/pkg/mod and stays root's: bootstrap
fills it as root and builder only reads it. The sources are copied with
--chown. A small chown, cached with bootstrap, hands builder the /src
directory itself, which git and make build need, and the telemetry
files root's go commands left in its home. Tests and the build still
run as builder.

Model: opus-5-5

TODO.md

@@ -29,6 +29,10 @@
 
 # Completed Steps
 
+- the `Dockerfile` build stage leaves the Go module cache root's and copies
+  the sources with `--chown`, so no `chown -R` walks them (2026-10-04,
+  https://git.eeqj.de/sneak/sfdupes/issues/43)
+
 - warn about and skip symlink, socket, FIFO, device and `.zfs`
   operands, keeping the records beneath them (2026-10-03,
   https://git.eeqj.de/sneak/sfdupes/issues/9)