Run the linter only in Docker (closes #20)

script/lint now builds the new Dockerfile.lint, whose last step runs
golangci-lint. The build cache is off, so every run executes the
linter, and no image is kept. The Dockerfile lint stage calls
golangci-lint directly, since make lint is now a docker build of its
own. script/fmt no longer runs golangci-lint --fix, and
script/bootstrap no longer installs it. golangci-lint config verify is
left out: it fetches its schema over the network, unpinned. The README,
TODO.md and the script/cibuild comment say what now runs.

Model: opus-5-5

README.md

@@ -113,16 +113,17 @@ development workflow, and the Makefile targets are thin shims that call them.
 The scripts are POSIX sh (not bash) so they run in minimal containers such as
 alpine. We provide:
 
-- `script/bootstrap` — install all dependencies (go and golangci-lint if
-  missing, then `go mod download`)
+- `script/bootstrap` — install all dependencies (go if missing, then
+  `go mod download`); golangci-lint is not installed, since it runs only in
+  Docker
 - `script/setup` — set up the repo for development after a fresh clone: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (our own extension); used by
   `script/docker` for the image tag
 - `script/test` — run the test suite (`go test -v ./...`)
-- `script/lint` — run golangci-lint
-- `script/fmt` — format all files (goimports plus `golangci-lint run --fix`;
-  writes)
+- `script/lint` — run golangci-lint in Docker by building `Dockerfile.lint`
+  without the build cache, so every run lints; keeps no image
+- `script/fmt` — format all files with goimports (writes)
 - `script/fmt-check` — check formatting (read-only); fails if `gofmt -l`
   reports files
 - `script/check` — run all checks: `test`, `lint`, `fmt-check` (our own