TODO.md no longer says that every stage of the Dockerfile declares
ARG CACHEBUST first: the issue 95 entry gets a note that since issue 109
the module download and the build stage's install come before it, and
the CHECK_EPOCH entry says the line comes before every step that lints,
tests or compiles. README says golangci-lint reuses a package's findings
only while the linters and their settings in .golangci.yml are
unchanged, as REPO_POLICIES.md does, not the whole file.
Model: opus-5-5