Dockerfile: golang:1.24-alpine (pinned by sha256), installs Node.js,
npm, golangci-lint (pinned by commit hash), and runs make check as a
build step so the image only builds on a green branch.
.gitea/workflows/check.yml: runs docker build . on push (actions/checkout
pinned by commit sha).
