user
e9f2a6baf9
The lint stage ran make fmt-check and make lint as separate steps and a second stage ran make test, so script/check was never exercised by the container gate. Collapse the verification into a single check stage that runs make check, and add a build stage that depends on it so docker build . runs the full suite and then builds. Reorder script/check to fmt-check, lint, test so the cheap checks fail first. Both FROM lines remain digest-pinned.