Say where ARG CACHEBUST sits now and what golangci-lint's cache checks

TODO.md no longer says that every stage of the Dockerfile declares
ARG CACHEBUST first: the issue 95 entry gets a note that since issue 109
the module download and the build stage's install come before it, and
the CHECK_EPOCH entry says the line comes before every step that lints,
tests or compiles. README says golangci-lint reuses a package's findings
only while the linters and their settings in .golangci.yml are
unchanged, as REPO_POLICIES.md does, not the whole file.

Model: opus-5-5

README.md

@@ -1138,8 +1138,9 @@ the modules downloaded again. Go's build cache is kept between builds on the
 steps that compile, so only what changed is compiled again; the tests run with
 `-count=1`, so none reports a stored result. `golangci-lint run` also keeps
 golangci-lint's cache, and takes a package's findings from it only when the
-package's files and those of the packages it imports, `go.mod`, `.golangci.yml`
-and the golangci-lint version are all unchanged.
+package's files and those of the packages it imports, `go.mod`, the linters and
+their settings in `.golangci.yml`, and the golangci-lint version are all
+unchanged.
 
 ## Build
 

TODO.md

@@ -163,7 +163,11 @@
   and the build stage installs `git` and `make` itself; a new push cancels the
   workflow's older run on the same branch, and a run stops after 20 minutes;
   `.claude/settings.json` is deleted (2026-10-15,
-  https://git.eeqj.de/sneak/sfdupes/issues/95)
+  https://git.eeqj.de/sneak/sfdupes/issues/95). Since
+  https://git.eeqj.de/sneak/sfdupes/issues/109 the module download in `lint`,
+  `test` and the build stage, and the install of `git` and `make` in the build
+  stage, come before `ARG CACHEBUST`, and Docker keeps them between builds;
+  every step that lints, tests or compiles still runs on every build
 
 - with `-x`, an operand under another operand is walked on its own instead of
   being dropped when a directory from it (from its directory, for a regular
@@ -364,9 +368,9 @@
   a `CHECK_EPOCH` build argument; since
   https://git.eeqj.de/sneak/sfdupes/issues/95 every `docker build` in `script/`
   passes a new `CACHEBUST` value instead, which every stage of the `Dockerfile`
-  declares first. Run as root, the tests fail
-  `TestScanHardlinkRunFailsTogether`, because root reads through the `chmod(0)`
-  the test relies on, so the `test` phase runs them as `nobody`
+  declares before every step that lints, tests or compiles. Run as root, the
+  tests fail `TestScanHardlinkRunFailsTogether`, because root reads through the
+  `chmod(0)` the test relies on, so the `test` phase runs them as `nobody`
 - check the installed golangci-lint version in `script/bootstrap` instead of
   only its presence (2026-08-09, branch `bootstrap-version-check`, closes
   https://git.eeqj.de/sneak/sfdupes/issues/24): the version lives only in