make tidy, and make check failing on an untidy go.mod or go.sum (closes #99)

script/tidy runs `go mod tidy` in a new tidy stage of the Dockerfile,
on the test phase's Go image, and writes go.mod and go.sum back into the
working tree with `docker build --output`. The test phase now runs
`go mod tidy -diff` before the tests and fails naming `make tidy`; it
comes first because a missing go.sum line otherwise fails the tests with
Go's own message.

Judgement call: script/tidy's build has no tag, unlike the other builds
in script/: it makes no image.

Model: opus-5-5

README.md

@@ -1401,10 +1401,10 @@ addresses are never sent to GeoJS.
 - `internal/alerts`: takes the alerts the other parts raise, holds back repeats
   and those past the hourly limit, and sends the others to the webhook, Slack
   and ntfy, each from a queue of its own.
-- `Dockerfile`: the lint and test phases, then the image, whose last stage
-  installs Ubuntu's packages, nixpkgs, `runsvinit` and `smallwebwaf`, with
-  `share/smallwebwaf.run` as runit's `run` script for `smallwebwaf` and
-  `share/rules.d/00-default.rules` as its default rule file.
+- `Dockerfile`: the lint and test phases, the stages `script/tidy` builds, then
+  the image, whose last stage installs Ubuntu's packages, nixpkgs, `runsvinit`
+  and `smallwebwaf`, with `share/smallwebwaf.run` as runit's `run` script for
+  `smallwebwaf` and `share/rules.d/00-default.rules` as its default rule file.
 - `deploy/example-app`: an app built on the image, which `script/example-app`
   checks.
 
@@ -1433,7 +1433,11 @@ so that they run in minimal containers.
   `script/install-precommit`.
 - `script/projectname`: prints the project's name, `smallwebwaf`, which
   `script/docker` and the others tag their images with.
-- `script/test`: runs the tests, as the `test` phase of the `Dockerfile`.
+- `script/test`: checks that `go.mod` and `go.sum` are as `go mod tidy` writes
+  them, then runs the tests, as the `test` phase of the `Dockerfile`.
+- `script/tidy`: writes `go.mod` and `go.sum` as `go mod tidy` writes them, with
+  the Go of the `test` phase, in the `tidy` stage of the `Dockerfile`;
+  `make tidy` runs it.
 - `script/lint`: runs golangci-lint, as the `lint` phase of the `Dockerfile`.
 - `script/fmt`: formats the Go code with `gofmt` and the Markdown with prettier.
 - `script/fmt-check`: checks the formatting, and changes nothing.