Dockerfile: run make check so the image build gates on all checks

The lint stage ran make fmt-check and make lint as separate steps and a
second stage ran make test, so script/check was never exercised by the
container gate. Collapse the verification into a single check stage that
runs make check, and add a build stage that depends on it so
docker build . runs the full suite and then builds.

Reorder script/check to fmt-check, lint, test so the cheap checks fail
first.

Both FROM lines remain digest-pinned.

Dockerfile

@@ -1,20 +1,21 @@
-# Lint stage: format check + golangci-lint
+# Check stage: the full verification suite (fmt-check + lint + test) via
+# `make check`, so any check failure fails the image build.
 # golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS check
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN make fmt-check
-RUN make lint
+RUN make check
 
-# Test stage: run full test suite
+# Build stage: compile on the Go toolchain the module targets. Copying
+# from the check stage makes the build depend on it, so `docker build .`
+# runs the checks first and only then builds.
 # golang 1.22.12 (2025-02-04)
-FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02 AS test
-# Depend on lint stage so both stages always run
-COPY --from=lint /src/go.sum /dev/null
+FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02 AS build
+COPY --from=check /src/go.sum /dev/null
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN make test
+RUN go build ./... && go build -o /out/example ./cmd/example