make tidy, and make check failing on an untidy go.mod or go.sum (closes #99)

script/tidy runs `go mod tidy` in a new tidy stage of the Dockerfile,
on the test phase's Go image, and writes go.mod and go.sum back into the
working tree with `docker build --output`. The test phase now runs
`go mod tidy -diff` before the tests and fails naming `make tidy`; it
comes first because a missing go.sum line otherwise fails the tests with
Go's own message.

Judgement call: script/tidy's build has no tag, unlike the other builds
in script/: it makes no image.

Model: opus-5-5

Dockerfile

@@ -29,6 +29,12 @@ RUN go mod download
 
 COPY . .
 
+# go.mod and go.sum must be as `go mod tidy` writes them, which is what
+# `make tidy` does. Checked before the tests, which a missing go.sum line
+# fails with a message that does not name `make tidy`.
+RUN go mod tidy -diff || \
+    { echo "go.mod or go.sum is not tidy: run make tidy" >&2; exit 1; }
+
 # Go's build cache is kept on a tmpfs, out of the image: nothing uses it
 # after this step, and writing it into the image takes seconds.
 RUN --mount=type=tmpfs,target=/root/.cache/go-build \
@@ -36,7 +42,25 @@ RUN --mount=type=tmpfs,target=/root/.cache/go-build \
     { echo "--- Rerunning with -v for details ---"; \
       go test -timeout 90s -race -v ./...; exit 1; }
 
-# Build stage. Nothing is wanted from the two phases above; the copies
+# Tidy stage: `go mod tidy` in the test phase's Go, so that the files it
+# writes pass the test phase's check. Nothing else depends on it, so only
+# script/tidy, which names the stage after it, builds it.
+#
+# golang 1.27.1-trixie, 2026-09-19
+FROM golang@sha256:3b77fc618ec235a1ab412de7737f120dd507c57e8d87de4cbb7994fb94275ed5 AS tidy
+
+WORKDIR /src
+
+COPY . .
+
+RUN go mod tidy
+
+# go.mod and go.sum alone, which script/tidy writes into the working tree.
+FROM scratch AS tidy-files
+
+COPY --from=tidy /src/go.mod /src/go.sum /
+
+# Build stage. Nothing is wanted from the lint and test phases; the copies
 # are what make BuildKit build them first, so the image, which needs this
 # stage, cannot be produced unless lint and test passed.
 #