Run the linter only in Docker (closes #20)

script/lint now builds the new Dockerfile.lint, whose last step runs
golangci-lint. The build cache is off, so every run executes the
linter, and no image is kept. The Dockerfile lint stage calls
golangci-lint directly, since make lint is now a docker build of its
own. script/fmt no longer runs golangci-lint --fix, and
script/bootstrap no longer installs it. golangci-lint config verify is
left out: it fetches its schema over the network, unpinned. The README,
TODO.md and the script/cibuild comment say what now runs.

Model: opus-5-5

script/lint

@@ -1,12 +1,15 @@
 #!/bin/sh
-# script/lint: run the linter.
+# script/lint: run the linter, in docker only, by building Dockerfile.lint;
+# the build fails on any finding. --no-cache makes every run execute the
+# linter: a cached build of an unchanged tree succeeds without linting
+# anything. --output type=cacheonly keeps no image.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    golangci-lint run
+    docker build --no-cache --output type=cacheonly -f Dockerfile.lint .
 }
 
 main "$@"