Run the linter only in Docker (closes #20)

script/lint now builds only the lint stage of the Dockerfile, without
the build cache, so every run executes the linter; the image is tagged
simplelog-lint. The lint stage calls golangci-lint directly, since make
lint is itself a docker build of that stage. script/cibuild and
script/docker also build without the cache, so their check steps always
run. script/fmt no longer runs golangci-lint --fix, and script/bootstrap
no longer installs it. golangci-lint config verify is left out, on the
owner's ruling. The README, TODO.md and the script/cibuild comment say
what now runs.

Model: opus-5-5

README.md

@@ -113,24 +113,27 @@ development workflow, and the Makefile targets are thin shims that call them.
 The scripts are POSIX sh (not bash) so they run in minimal containers such as
 alpine. We provide:
 
-- `script/bootstrap` — install all dependencies (go and golangci-lint if
-  missing, then `go mod download`)
+- `script/bootstrap` — install all dependencies (go if missing, then
+  `go mod download`); golangci-lint is not installed, since it runs only in
+  Docker
 - `script/setup` — set up the repo for development after a fresh clone: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (our own extension); used by
   `script/docker` for the image tag
 - `script/test` — run the test suite (`go test -v ./...`)
-- `script/lint` — run golangci-lint
-- `script/fmt` — format all files (goimports plus `golangci-lint run --fix`;
-  writes)
+- `script/lint` — run golangci-lint in Docker by building only the `lint`
+  stage of the `Dockerfile` (which also runs the format check), without the
+  build cache, so every run lints; the image is tagged `simplelog-lint`
+- `script/fmt` — format all files with goimports (writes)
 - `script/fmt-check` — check formatting (read-only); fails if `gofmt -l`
   reports files
 - `script/check` — run all checks: `test`, `lint`, `fmt-check` (our own
   extension)
-- `script/docker` — build the Docker image, tagged via `script/projectname`
-  (byte-identical across repos)
-- `script/cibuild` — cd to the repo root and `docker build .` (what CI runs;
-  the image build runs the checks)
+- `script/docker` — build the Docker image without the build cache, tagged
+  via `script/projectname` (byte-identical across repos)
+- `script/cibuild` — cd to the repo root and build the Docker image without the
+  build cache, tagged via `script/projectname` (what CI runs; the image build
+  runs the checks)
 - `script/precommit` — run by the git pre-commit hook (our own extension);
   runs a `go mod tidy` guard, then `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own