Rewrites CI to use a multi-stage Dockerfile per REPO_POLICIES:
- Lint stage: golangci/golangci-lint:v2.1.6-alpine runs make fmt-check
and make lint
- Build stage: golang:1.24.4-alpine runs make test, then builds binary
with CGO enabled (required for mattn/go-sqlite3)
- Runtime stage: alpine:3.21 copies binary, runs as non-root user
All base images pinned by @sha256 hash.
CI workflow simplified to just 'docker build .' since the Dockerfile
already runs make check (fmt-check + lint + test).
Makefile aligned with REPO_POLICIES:
- check target uses prereqs (fmt-check lint test)
- fmt-check is read-only (gofmt -l, not go fmt)
- Added docker and hooks targets
- test uses -race -timeout 30s
Added .dockerignore for efficient build context.
