Run the linter only in Docker (closes #20)

script/lint now builds the new Dockerfile.lint, whose last step runs
golangci-lint. The build cache is off, so every run executes the
linter, and no image is kept. The Dockerfile lint stage calls
golangci-lint directly, since make lint is now a docker build of its
own. script/fmt no longer runs golangci-lint --fix, and
script/bootstrap no longer installs it. golangci-lint config verify is
left out: it fetches its schema over the network, unpinned. The README,
TODO.md and the script/cibuild comment say what now runs.

Model: opus-5-5

Dockerfile

@@ -6,7 +6,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN make fmt-check
-RUN make lint
+# Called directly: make lint is itself a docker build (Dockerfile.lint).
+RUN golangci-lint run --config .golangci.yml ./...
 
 # Test stage: run full test suite
 # golang 1.22.12 (2025-02-04)