Fail a bare docker build instead of serving cached gates (closes #39)

Each Dockerfile stage that runs gates now checks, right after its
ARG CHECK_EPOCH, that the value is not empty, and stops with a message
naming script/cibuild and script/docker. A plain `docker build .` can
no longer report a green from cached gate layers.

script/cibuild and script/docker now append the process id to the
epoch, the form script/lint already uses, so two runs started in the
same second still get different values.

README says both. TODO.md corrects the steady-state CACHED count
recorded for issue 32 from twelve to thirteen.

Model: opus-5-5

script/docker

@@ -3,7 +3,7 @@
 # The tag comes from script/projectname.
 #
 # CHECK_EPOCH is passed for the same reason script/cibuild passes it:
-# without it Docker serves the Dockerfile's gate layers from cache on an
+# without a fresh value Docker serves the gate layers from cache on an
 # unchanged tree and this exits 0 having run none of the lint stage's
 # gates, the markdown stage's prettier gate or the builder stage's test
 # gate. This is the set of gates a developer or reviewer runs by hand,
@@ -17,7 +17,7 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 main() {
     cd "$ROOT"
     docker build \
-        --build-arg CHECK_EPOCH="$(date +%s)" \
+        --build-arg CHECK_EPOCH="$(date +%s)-$$" \
         -t "$("$SCRIPT_DIR/projectname")" \
         .
 }