Make the CI gate execute the checks it reports on (closes #119)

The workflow writes a build-context fingerprint before calling script/cibuild, so a code commit invalidates the COPY layer of the lint and builder stages and the checks really run, while a docs-only commit still replays from cache. A superseding run also rewrites the exact failure/Has been cancelled status left on commits that were never tested to skipped, so cancellation no longer reads as red. script/cibuild itself is untouched.

.dockerignore

@@ -1,3 +1,6 @@
+# .ci-fingerprint is deliberately NOT excluded: it is the CI cache barrier
+# that keeps the check stages from replaying a cached pass. See the lint
+# stage of the Dockerfile.
 .git/
 bin/
 *.md