Keep modules, lint cache and system packages in check builds (closes #109)

Re-vendors REPO_POLICIES.md, script/cibuild, script/docker, script/lint
and script/test from sneak/prompts next at 0653579, on sneak's ruling in
sneak/prompts#130. In the lint, test and
builder stages of the Dockerfile, the module download, and in builder
the apk install, move above ARG CACHEBUST, so Docker keeps those layers
until the base image, the install line, go.mod or go.sum changes.
golangci-lint run also mounts golangci-lint's cache. Every step that
lints, tests or compiles still comes after ARG CACHEBUST, and go test
keeps -count=1 and -race. README and TODO.md say the same.

Model: opus-5-5

README.md

@@ -1125,13 +1125,21 @@ entrypoints are:
 - `script/install-precommit` — install the git pre-commit hook, as
   `.git/hooks/pre-commit`, that runs `script/precommit`.
 
-Every `docker build` in `script/` passes a new `CACHEBUST` build argument, which
-every stage of the `Dockerfile` declares first, so every `RUN` step runs again
-each time. On an unchanged tree Docker would otherwise serve the gate steps from
-its cache, and the build would pass having run no test and no linter. Go's build
-cache is kept between builds on the steps that compile, so only what changed is
-compiled again; the tests run with `-count=1`, so none reports a stored result.
-Every run downloads the Go modules again and needs the network.
+Every `docker build` in `script/` passes a new `CACHEBUST` build argument. In
+every stage of the `Dockerfile`, `ARG CACHEBUST` comes right after the steps
+that install system packages and download the Go modules, or right after `FROM`
+in a stage with neither, and every step that lints, tests or compiles comes
+after it, so every `RUN` step after it runs again each time. On an unchanged
+tree Docker would otherwise serve the gate steps from its cache, and the build
+would pass having run no test and no linter. The layers above that line stay in
+Docker's build cache until the base image, their own lines, `go.mod` or `go.sum`
+change, or until that cache is cleared; only then are the packages installed and
+the modules downloaded again. Go's build cache is kept between builds on the
+steps that compile, so only what changed is compiled again; the tests run with
+`-count=1`, so none reports a stored result. `golangci-lint run` also keeps
+golangci-lint's cache, and takes a package's findings from it only when the
+package's files and those of the packages it imports, `go.mod`, `.golangci.yml`
+and the golangci-lint version are all unchanged.
 
 ## Build