Say where ARG CACHEBUST sits now and what golangci-lint's cache checks

TODO.md no longer says that every stage of the Dockerfile declares
ARG CACHEBUST first: the issue 95 entry gets a note that since issue 109
the module download and the build stage's install come before it, and
the CHECK_EPOCH entry says the line comes before every step that lints,
tests or compiles. README says golangci-lint reuses a package's findings
only while the linters and their settings in .golangci.yml are
unchanged, as REPO_POLICIES.md does, not the whole file.

Model: opus-5-5

README.md

@@ -1138,8 +1138,9 @@ the modules downloaded again. Go's build cache is kept between builds on the
 steps that compile, so only what changed is compiled again; the tests run with
 `-count=1`, so none reports a stored result. `golangci-lint run` also keeps
 golangci-lint's cache, and takes a package's findings from it only when the
-package's files and those of the packages it imports, `go.mod`, `.golangci.yml`
-and the golangci-lint version are all unchanged.
+package's files and those of the packages it imports, `go.mod`, the linters and
+their settings in `.golangci.yml`, and the golangci-lint version are all
+unchanged.
 
 ## Build