Run all linting in Docker via Dockerfile.lint (closes #188)

golangci-lint now runs only in Docker. New Dockerfile.lint (pinned
golangci-lint v2.12.2) COPYs the tree and runs the linter as a build
step; script/lint just builds it. A GATE_RUN build arg differs every
run, so the lint layer always executes -- a cached build would exit 0
having linted nothing.

config verify is deliberately omitted: it fetches its JSON schema over
an unpinned live HTTPS call, which REPO_POLICIES.md forbids.

script/bootstrap no longer installs golangci-lint (goimports kept). The
main Dockerfile lint stage now invokes golangci-lint directly rather
than make lint, so building it is not docker-in-docker.

Model: opus-4-8

TODO.md

@@ -20,6 +20,12 @@ main cannot regress.
 
 # Completed Steps
 
+- 2026-09-22: Linting now runs only in Docker. Added `Dockerfile.lint`
+  (pinned golangci-lint v2.12.2, cache-busted via a `GATE_RUN` build arg
+  so the linter always executes), reduced `script/lint` to building it,
+  dropped the golangci-lint install from `script/bootstrap`, and switched
+  the `Dockerfile` lint stage to invoke `golangci-lint` directly instead
+  of `make lint` to avoid docker-in-docker (#188).
 - 2026-09-22: Added `.prettierignore` so `make fmt` no longer rewrites
   the vendored `static/js/alpine.min.js` bundle (#185).
 - 2026-09-22: Fixed the gosec G703 path-traversal finding in the deploy