Pin alpine:latest to the full patch-level tag alpine:3.22.1 so Renovate
can classify patch/minor/major bumps on it. Add a `test` stage (bats)
and a `lint` stage (shellcheck, severity=error) that build from `base`
before ENTRYPOINT is set, so CI can run them without an --entrypoint
override. A trailing `FROM base` keeps the lean prod image as the
default `docker build .` target despite the extra stages.