Make the CI gate execute the checks it reports on (closes #119)

The workflow writes a build-context fingerprint before calling script/cibuild, so a code commit invalidates the COPY layer of the lint and builder stages and the checks really run, while a docs-only commit still replays from cache. A superseding run also rewrites the exact failure/Has been cancelled status left on commits that were never tested to skipped, so cancellation no longer reads as red. script/cibuild itself is untouched.

.gitignore

@@ -41,4 +41,7 @@ data/
 
 # Temporary files
 tmp/
-temp/ 
+temp/
+
+# CI cache barrier, written into the build context by the check workflow
+.ci-fingerprint