Dockerfile: run make check so the image build gates on all checks

The lint stage ran make fmt-check and make lint as separate steps and a
second stage ran make test, so script/check was never exercised by the
container gate. Collapse the verification into a single check stage that
runs make check, and add a build stage that depends on it so
docker build . runs the full suite and then builds.

Reorder script/check to fmt-check, lint, test so the cheap checks fail
first.

Both FROM lines remain digest-pinned.

script/check

@@ -1,14 +1,14 @@
 #!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
+# script/check: run all checks (fmt-check, lint, test). Our own
 # extension to scripts-to-rule-them-all. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 
 main() {
-    "$SCRIPT_DIR/test"
-    "$SCRIPT_DIR/lint"
     "$SCRIPT_DIR/fmt-check"
+    "$SCRIPT_DIR/lint"
+    "$SCRIPT_DIR/test"
 }
 
 main "$@"