Run all linting in Docker via Dockerfile.lint (closes #188)

Per the owner ruling, linting now runs only inside Docker with the
pinned golangci-lint (v2.12.2). A root Dockerfile.lint runs the linter as
a build step; script/lint just builds it. A GATE_RUN build arg forces the
lint layer to execute every run so a cached build cannot report a false
clean. script/bootstrap no longer installs golangci-lint (the goimports
install stays). The main Dockerfile lint stage calls golangci-lint
directly (no docker-in-docker) and still gates the build. config verify is
omitted because it fetches its schema over an unpinned HTTPS call.

Model: opus-4-8

TODO.md

@@ -20,6 +20,12 @@ main cannot regress.
 
 # Completed Steps
 
+- 2026-09-22: Linting now runs only in Docker. Added `Dockerfile.lint`
+  (pinned golangci-lint v2.12.2, cache-busted via a `GATE_RUN` build arg
+  so the linter always executes), reduced `script/lint` to building it,
+  dropped the golangci-lint install from `script/bootstrap`, and switched
+  the `Dockerfile` lint stage to invoke `golangci-lint` directly instead
+  of `make lint` to avoid docker-in-docker (#188).
 - 2026-09-22: Added `.prettierignore` so `make fmt` no longer rewrites
   the vendored `static/js/alpine.min.js` bundle (#185).
 - 2026-09-22: Fixed the gosec G703 path-traversal finding in the deploy