Fail a bare docker build instead of serving cached gates (closes #39)

Each Dockerfile stage that runs gates now checks, right after its
ARG CHECK_EPOCH, that the value is not empty, and stops with a message
naming script/cibuild and script/docker. A plain `docker build .` can
no longer report a green from cached gate layers.

script/cibuild and script/docker now append the process id to the
epoch, the form script/lint already uses, so two runs started in the
same second still get different values.

README says both. TODO.md corrects the steady-state CACHED count
recorded for issue 32 from twelve to thirteen.

Model: opus-5-5

README.md

@@ -821,9 +821,12 @@ from binary-versus-pin to pin-versus-pin, which is what
 gate layers from cache and the build exits 0 having executed no tests and no
 lint — a green it never earned, and one this repository has produced twice.
 `CHECK_EPOCH` invalidates the gate layers on every run while leaving the pinned
-base images and the dependency layers cached. `script/lint`'s value carries the
-process id as well as the epoch, because two lint runs land inside the same
-second easily and a bare epoch would cache the second one.
+base images and the dependency layers cached. Each script's value carries the
+process id as well as the epoch, because two runs land inside the same second
+easily and a bare epoch would cache the second one. Each `Dockerfile` stage with
+gates fails when the value is empty, so a bare `docker build .` stops with
+`CHECK_EPOCH is unset; build via script/cibuild or script/docker` instead of
+serving the gates from cache.
 
 ## Build