Fail a bare docker build instead of serving cached gates (closes #39)

Each Dockerfile stage that runs gates now checks, right after its
ARG CHECK_EPOCH, that the value is not empty, and stops with a message
naming script/cibuild and script/docker. A plain `docker build .` can
no longer report a green from cached gate layers.

script/cibuild and script/docker now append the process id to the
epoch, the form script/lint already uses, so two runs started in the
same second still get different values.

README says both. TODO.md corrects the steady-state CACHED count
recorded for issue 32 from twelve to thirteen.

Model: opus-5-5

Dockerfile

@@ -10,7 +10,9 @@ COPY . .
 # invalidates COPY only when the copied content changes, so on an
 # unchanged tree the gates below would be served from cache and the
 # build would exit 0 having run nothing. script/cibuild and
-# script/docker pass a fresh CHECK_EPOCH on every invocation.
+# script/docker pass a fresh CHECK_EPOCH on every invocation. A build
+# that passes none, such as a bare `docker build .`, fails at the check
+# right after the ARG instead of quietly serving the gates from cache.
 #
 # Two properties this depends on. ARG is per-stage, so the markdown and
 # build stages below declare it again; one declaration here would leave
@@ -22,6 +24,10 @@ COPY . .
 # (the pinned base image, go mod download) keeps its cache; only the
 # gates go cold.
 ARG CHECK_EPOCH
+RUN if [ -z "${CHECK_EPOCH}" ]; then \
+        echo "CHECK_EPOCH is unset; build via script/cibuild or script/docker" >&2; \
+        exit 1; \
+    fi
 
 # The linter is invoked directly here, not through `make lint`. That
 # target now runs `docker build -f Dockerfile.lint`, and a docker build
@@ -71,9 +77,13 @@ WORKDIR /src
 # Markdown stage: the Markdown half of `make fmt-check`, as a gate.
 FROM prettier AS markdown
 COPY . .
-# Second per-stage declaration of the gate cache-buster; see the lint
-# stage above.
+# Second per-stage declaration of the gate cache-buster and its check;
+# see the lint stage above.
 ARG CHECK_EPOCH
+RUN if [ -z "${CHECK_EPOCH}" ]; then \
+        echo "CHECK_EPOCH is unset; build via script/cibuild or script/docker" >&2; \
+        exit 1; \
+    fi
 RUN echo "gate prettier, epoch ${CHECK_EPOCH}" && \
     prettier --check '**/*.md' --tab-width 4 --prose-wrap always
 
@@ -153,10 +163,15 @@ USER builder
 # prerequisites. `make`, not the script directly, because the Makefile's
 # `export CGO_ENABLED = 0` applies only to what it invokes.
 #
-# Third per-stage declaration of the gate cache-buster; see the lint
-# stage above for why one is not enough. It is placed after USER so the
-# drop to the unprivileged user still happens before the checks run.
+# Third per-stage declaration of the gate cache-buster and its check;
+# see the lint stage above for why one is not enough. It is placed after
+# USER so the drop to the unprivileged user still happens before the
+# checks run.
 ARG CHECK_EPOCH
+RUN if [ -z "${CHECK_EPOCH}" ]; then \
+        echo "CHECK_EPOCH is unset; build via script/cibuild or script/docker" >&2; \
+        exit 1; \
+    fi
 RUN echo "gate test, epoch ${CHECK_EPOCH}" && make test
 
 # The version stamped into the binary: the VERSION build argument when