make tidy, and make check failing on an untidy go.mod or go.sum (closes #99)

script/tidy runs `go mod tidy` in a new tidy stage of the Dockerfile,
on the test phase's Go image, and writes go.mod and go.sum back into the
working tree with `docker build --output`. The test phase now runs
`go mod tidy -diff` before the tests and fails naming `make tidy`; it
comes first because a missing go.sum line otherwise fails the tests with
Go's own message.

Judgement call: script/tidy's build has no tag, unlike the other builds
in script/: it makes no image.

Model: opus-5-5

script/tidy

@@ -0,0 +1,19 @@
+#!/bin/sh
+# script/tidy: write go.mod and go.sum as `go mod tidy` writes them, which
+# the test phase of the Dockerfile checks. This builds the Dockerfile's
+# tidy-files stage, which holds the two files alone, and --output writes
+# them into the working tree. The build makes no image, so it has no tag.
+# --no-cache because `go mod tidy` asks the module proxy, whose answers a
+# cached layer would repeat.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build --no-cache \
+        --target tidy-files \
+        --output "type=local,dest=$ROOT" .
+}
+
+main "$@"