Run the linter only in Docker (closes #20)

script/lint now builds only the lint stage of the Dockerfile, without
the build cache, so every run executes the linter; the image is tagged
simplelog-lint. The lint stage calls golangci-lint directly, since make
lint is itself a docker build of that stage. script/cibuild and
script/docker also build without the cache, so their check steps always
run. script/fmt no longer runs golangci-lint --fix, and script/bootstrap
no longer installs it. golangci-lint config verify is left out, on the
owner's ruling. The README, TODO.md and the script/cibuild comment say
what now runs.

Model: opus-5-5

TODO.md

@@ -24,6 +24,10 @@ files it depends on: .golangci.yml, REPO_POLICIES.md, .editorconfig,
 
 # Completed Steps
 
+* 2026-10-06: the linter runs only in Docker: `script/lint` builds the
+    `lint` stage of the `Dockerfile`, every `docker build` in `script/`
+    runs without the build cache, and `script/bootstrap` no longer
+    installs golangci-lint
 * 2026-10-06: every handler now returns a failed delivery from `Handle`
     instead of discarding it: console and JSON return the stdout write
     error, the webhook also fails on a non-2xx answer, and the multiplex
@@ -51,9 +55,6 @@ files it depends on: .golangci.yml, REPO_POLICIES.md, .editorconfig,
 
 # Future Steps
 
-* Rewrite the Dockerfile to run make check with sha256-pinned base
-    images (currently golangci/golangci-lint:latest and golang:1.22,
-    unpinned, duplicating Makefile logic instead of calling it)
 * Restructure README.md into the standard sections: Description,
     Getting Started, Rationale, Design, TODO, License, Author
 * Delete the old plain TODO file once this TODO.md lands