Keep modules, lint cache and system packages in check builds (closes #109)

Re-vendors REPO_POLICIES.md and script/cibuild, docker, lint and test
from sneak/prompts at 0653579, on sneak's ruling in
sneak/prompts#130. In the Dockerfile's lint,
test and builder stages, the system-package install and the module
download now come before ARG CACHEBUST, so Docker keeps those layers
until the base image, the install line, go.mod or go.sum changes.
golangci-lint run also mounts golangci-lint's cache. Every step that
lints, tests or compiles still runs on every check build, and go test
keeps -count=1 and -race. README and TODO.md say the same.

Model: opus-5-5

README.md

@@ -1125,13 +1125,22 @@ entrypoints are:
 - `script/install-precommit` — install the git pre-commit hook, as
   `.git/hooks/pre-commit`, that runs `script/precommit`.
 
-Every `docker build` in `script/` passes a new `CACHEBUST` build argument, which
-every stage of the `Dockerfile` declares first, so every `RUN` step runs again
-each time. On an unchanged tree Docker would otherwise serve the gate steps from
-its cache, and the build would pass having run no test and no linter. Go's build
-cache is kept between builds on the steps that compile, so only what changed is
-compiled again; the tests run with `-count=1`, so none reports a stored result.
-Every run downloads the Go modules again and needs the network.
+Every `docker build` in `script/` passes a new `CACHEBUST` build argument. In
+every stage of the `Dockerfile`, `ARG CACHEBUST` comes right after the steps
+that install system packages and download the Go modules, or right after `FROM`
+in a stage with neither, and every step that lints, tests or compiles comes
+after it, so every `RUN` step after it runs again each time. On an unchanged
+tree Docker would otherwise serve the gate steps from its cache, and the build
+would pass having run no test and no linter. The layers above that line stay in
+Docker's build cache until the base image, their own lines, `go.mod` or `go.sum`
+change, or until that cache is cleared; only then are the packages installed and
+the modules downloaded again. Go's build cache is kept between builds on the
+steps that compile, so only what changed is compiled again; the tests run with
+`-count=1`, so none reports a stored result. `golangci-lint run` also keeps
+golangci-lint's cache, and takes a package's findings from it only when the
+package's files and those of the packages it imports, `go.mod`, the linters and
+their settings in `.golangci.yml`, and the golangci-lint version are all
+unchanged.
 
 ## Build