Make a missing CHECK_EPOCH fail the build instead of faking it (closes #91)

Adopt the four remaining upstream CHECK_EPOCH hardening items from
sneak/prompts #26, closing the gap #85 left open deliberately.

Fail closed on a missing value. Each check stage now asserts
`[ -n "$CHECK_EPOCH" ] || exit 1` before running anything. An unset ARG
is an empty string and an empty string is a stable cache key, so the
second and every later bare `docker build .` on an unchanged tree
replayed all three check layers, executed nothing, and still exited 0 --
and `docker build .` is the command REPO_POLICIES.md names verbatim as a
thing that must be green, so the documented command was precisely the
one that lied. Failed steps are never cached, which is what makes the
guard fire on every invocation rather than once.

Expand the epoch into each check command rather than leaving it a bare
declaration, so the cache miss does not depend on BuildKit's
unreferenced-ARG handling staying as it is, and so the value appears in
the build log where a reader can see the layer was keyed fresh.

Make the epoch unique per invocation rather than per second:
`epoch="$(date +%s%N)$$"`. `%N` alone is not enough, since busybox drops
it silently and exits 0, handing back second granularity with no
warning; `$$` differs between concurrent invocations regardless. The
bare-assignment form is kept on purpose -- inlined into an argument, a
failing substitution does not abort under `set -eu` and would yield an
empty constant epoch, restoring the exact false green this prevents.

Pass the same fresh value from script/docker. It is not the CI gate, but
local builds are almost always warm, so it was the likelier fooling in
practice, and two entrypoints disagreeing about whether the tree is
green is worse than either being wrong alone.

The ARG placement from #85 is unchanged, below apk add, COPY go.mod
go.sum and go mod download, so dependency layers still cache and the
build is not cold. Verified by negative control rather than inspection;
measurements are recorded once, in the PR verification comment.

.golangci.yml, the lint-stage FROM line and its digest, script/lint,
REPO_POLICIES.md and .gitea/workflows/check.yml are untouched.

Dockerfile

@@ -23,32 +23,32 @@ COPY . .
 #
 # CHECK_EPOCH must stay immediately above these RUNs. These layers are
 # keyed on its value, so they are cache-eligible only for a value
-# already built against this same tree. script/cibuild passes a fresh
-# value on every invocation, which is what makes its green mean the
-# checks really executed.
+# already built against this same tree. script/cibuild and script/docker
+# each pass a fresh value on every invocation, which is what makes their
+# green mean the checks really executed.
 #
-# The guarantee is conditional on that fresh value, not absolute. A
-# build that omits --build-arg -- a bare `docker build .` -- gets an
-# empty CHECK_EPOCH, and an empty string is a constant: the first such
-# build runs the checks, and every one after it on an unchanged tree
-# replays these layers from cache, never executing a check and still
-# exiting 0, a green nothing earned. Gate through script/cibuild.
-# Making the missing-arg case fail loudly instead is tracked in #91.
+# The value is expanded into each check command rather than left to a
+# bare declaration, so the cache miss does not depend on BuildKit's
+# unreferenced-ARG handling staying as it is. It also puts the epoch in
+# the build log, where a reader can see the layer was keyed fresh.
 #
-# CHECK_EPOCH is deliberately not referenced by the commands below: a
-# declared-but-unreferenced ARG does enter BuildKit's cache key, which
-# is measured on this host rather than assumed (PR #89). Upstream
-# sneak/prompts #26 prefers expanding the value into the command so
-# that the miss is contractual rather than dependent on that behavior
-# staying as it is; adopting that here is tracked in #91. Do not delete
-# this ARG as dead code -- the gate depends on it.
+# The guard is what makes a build that omits --build-arg fail instead of
+# lie. An unset ARG is an empty string, and an empty string is a
+# perfectly stable cache key: without the guard the first such build
+# runs the checks and every one after it on an unchanged tree replays
+# these layers from cache, executes nothing, and still exits 0. Failed
+# steps are never cached, so the guard fails on EVERY invocation rather
+# than once -- a bare `docker build .` is now a loud error, not a quiet
+# green. Do not give CHECK_EPOCH a default value; a default would
+# satisfy the guard with a constant and restore the hole.
 #
 # ARG scope is per-stage, so the builder stage declares its own.
 # Everything above this line (apk, go.mod, `go mod download`) is
 # deliberately outside the busted range and keeps caching.
 ARG CHECK_EPOCH
-RUN make fmt-check
-RUN make lint
+RUN [ -n "$CHECK_EPOCH" ] || exit 1
+RUN echo "check epoch: ${CHECK_EPOCH}" && make fmt-check
+RUN echo "check epoch: ${CHECK_EPOCH}" && make lint
 
 # Build stage
 # golang:1.26.1-alpine, 2026-03-17
@@ -71,12 +71,13 @@ RUN go mod download
 # Copy source code
 COPY . .
 
-# Run tests. See the CHECK_EPOCH comment in the lint stage, including
-# the conditions the guarantee depends on; ARG scope is per-stage, so
-# this stage needs its own declaration, and it must stay immediately
-# above the check RUN.
+# Run tests. See the CHECK_EPOCH comment in the lint stage for the
+# mechanism; ARG scope is per-stage, so this stage needs its own
+# declaration, its own guard, and its own expansion, and they must stay
+# immediately above the check RUN.
 ARG CHECK_EPOCH
-RUN make test
+RUN [ -n "$CHECK_EPOCH" ] || exit 1
+RUN echo "check epoch: ${CHECK_EPOCH}" && make test
 
 # Build (pure Go, no CGO required since we use modernc.org/sqlite)
 RUN CGO_ENABLED=0 go build -ldflags "-X 'sneak.berlin/go/vaultik/internal/globals.Version=${VERSION}' -X 'sneak.berlin/go/vaultik/internal/globals.Commit=$(git rev-parse HEAD 2>/dev/null || echo unknown)' -X 'sneak.berlin/go/vaultik/internal/globals.CommitDate=$(git show -s --format=%cs HEAD 2>/dev/null || echo unknown)'" -o /vaultik ./cmd/vaultik