Dockerfile: run make check so the image build gates on all checks

The lint stage ran make fmt-check and make lint as separate steps and a
second stage ran make test, so script/check was never exercised by the
container gate. Collapse the verification into a single check stage that
runs make check, and add a build stage that depends on it so
docker build . runs the full suite and then builds.

Reorder script/check to fmt-check, lint, test so the cheap checks fail
first.

Both FROM lines remain digest-pinned.

Dockerfile

@@ -1,20 +1,21 @@
-# Lint stage: format check + golangci-lint
+# Check stage: the full verification suite (fmt-check + lint + test) via
+# `make check`, so any check failure fails the image build.
 # golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS check
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN make fmt-check
+RUN make check
-RUN make lint
 
-# Test stage: run full test suite
+# Build stage: compile on the Go toolchain the module targets. Copying
+# from the check stage makes the build depend on it, so `docker build .`
+# runs the checks first and only then builds.
 # golang 1.22.12 (2025-02-04)
-FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02 AS test
+FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02 AS build
-# Depend on lint stage so both stages always run
+COPY --from=check /src/go.sum /dev/null
-COPY --from=lint /src/go.sum /dev/null
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN make test
+RUN go build ./... && go build -o /out/example ./cmd/example

script/check

@@ -1,14 +1,14 @@
 #!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
+# script/check: run all checks (fmt-check, lint, test). Our own
 # extension to scripts-to-rule-them-all. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 
 main() {
-    "$SCRIPT_DIR/test"
-    "$SCRIPT_DIR/lint"
     "$SCRIPT_DIR/fmt-check"
+    "$SCRIPT_DIR/lint"
+    "$SCRIPT_DIR/test"
 }
 
 main "$@"