Build the CI checks instead of bind-mounting them

The job runs inside a container, so -v "$PWD" mounted a path the Docker
daemon doesn't have and npm ci found no lockfile. Dockerfile.check sends
the repo as a build context instead. The gate itself worked: the image
build was skipped rather than pushing something unchecked.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.dockerignore

@@ -12,6 +12,7 @@ data
 .DS_Store
 npm-debug.log*
 Dockerfile
+Dockerfile.check
 .dockerignore
 docker-compose.yml
 extracted

.forgejo/workflows/build.yml

@@ -17,11 +17,9 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Lint and test
-        # In the runner's own Docker, so this needs no extra actions. A failure
+        # Built, not mounted: this job runs in a container, so a host bind mount
-        # here stops the image being built, rather than deploying a broken one.
+        # of $PWD arrives empty. A failure here stops the image being built.
-        run: |
+        run: docker build -f Dockerfile.check -t printhive-check .
-          docker run --rm -v "$PWD":/src -w /src node:22-bookworm-slim \
-            sh -c "npm ci --no-audit --no-fund && npm run lint && npm test"
 
       - name: Log in to the Forgejo container registry
         # REGISTRY_TOKEN = a Forgejo access token with write:package scope, added

Dockerfile.check

@@ -0,0 +1,11 @@
+# Lint and tests, run in CI. A build context rather than a bind mount, because
+# the CI job runs inside a container of its own — $PWD there means nothing to
+# the Docker daemon, so a mounted folder arrives empty.
+FROM node:22-bookworm-slim
+WORKDIR /src
+
+COPY package.json package-lock.json ./
+RUN npm ci --no-audit --no-fund
+
+COPY . .
+RUN npm run lint && npm test