The lint stage ran make fmt-check and make lint as separate steps and a
second stage ran make test, so script/check was never exercised by the
container gate. Collapse the verification into a single check stage that
runs make check, and add a build stage that depends on it so
docker build . runs the full suite and then builds.
Reorder script/check to fmt-check, lint, test so the cheap checks fail
first.
Both FROM lines remain digest-pinned.
user
sneak