make tidy, and make check failing on an untidy go.mod or go.sum (closes #99)

script/tidy runs `go mod tidy` in a new tidy stage of the Dockerfile,
on the test phase's Go image, and writes go.mod and go.sum back into the
working tree with `docker build --output`. The test phase now runs
`go mod tidy -diff` before the tests and fails naming `make tidy`; it
comes first because a missing go.sum line otherwise fails the tests with
Go's own message.

Judgement call: script/tidy's build has no tag, unlike the other builds
in script/: it makes no image.

Model: opus-5-5

Makefile

@@ -1,9 +1,10 @@
-.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks build run \
-	example-app
+.PHONY: bootstrap setup test lint fmt fmt-check tidy check docker hooks build \
+	run example-app
 
 # Makefile targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
-# of README.md). build and run are for working on the code by hand;
+# of README.md). tidy writes go.mod and go.sum as `go mod tidy` does,
+# which test checks. build and run are for working on the code by hand;
 # example-app checks the image with an app built on it.
 
 bootstrap:
@@ -24,6 +25,9 @@ fmt:
 fmt-check:
 	@script/fmt-check
 
+tidy:
+	@script/tidy
+
 check:
 	@script/check