fix(scripts/dogfood): pass GO_LINT_NEW_CODE_BASE to the image lint run (#30851)

Fixes the `build_image (26.04)` failure in the `dogfood` workflow on PRs
into `main` (seen on #30807). Tracked in
[ENT-213](https://linear.app/codercom/issue/ENT-213).

## Problem

`lint/go/new-code` (added in #30622) runs `.golangci.new-code.yaml` with
`--new-from-merge-base=$(GO_LINT_NEW_CODE_BASE)`, which defaults to
`origin/main`. `ci.yaml` sets `GO_LINT_NEW_CODE_BASE` to `HEAD^1` for
PRs and `HEAD` otherwise. `scripts/dogfood/test_image.sh` doesn't pass
it into the container, and the dogfood checkout (depth 2) has no
`origin/main`. So `make lint` inside the image reports the whole tree
(1263 issues: errcheck 437, forbidigo 42, nolintlint 784) and fails
"Test image tooling".

Pushes to `main` run the same validation before pushing the image, so
the next dogfood-triggering merge to `main` would also fail and skip the
Docker Hub push.

## Change

`scripts/dogfood/test_image.sh` only:

- Under GitHub Actions, and when `GO_LINT_NEW_CODE_BASE` isn't already
set, default it to `HEAD^1` for `pull_request` and `HEAD` otherwise,
mirroring `ci.yaml`.
- Forward it into the container with `--env GO_LINT_NEW_CODE_BASE`.
- Local runs are unchanged: the variable stays unset unless you set it,
so the Makefile default (`origin/main`) applies.

This PR touches `scripts/dogfood/**`, which triggers the `dogfood`
workflow, so its own `build_image (26.04)` run is the end-to-end test.

Opened by Superblink on behalf of @droopy4096.

Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com>
Co-authored-by: Dmitry Makovey <dmakovey@yahoo.com>

scripts/dogfood/test_image.sh

@@ -14,6 +14,11 @@
 #                     (optional for local runs).
 #   GITHUB_BASE_REF   Base branch for diff-only lint checks (e.g. emdash).
 #                     Set automatically by GitHub Actions for PRs.
+#   GO_LINT_NEW_CODE_BASE
+#                     Revision lint/go/new-code diffs against. Defaults to the
+#                     Makefile's origin/main locally; under GitHub Actions it
+#                     defaults to HEAD^1 for PRs and HEAD otherwise, as in
+#                     ci.yaml.
 #   CI                When set, fmt targets run in check-mode and actionlint
 #                     is excluded from make lint (it runs separately in CI).
 #   STEPS             Space-separated list of steps to run. Defaults to all.
@@ -49,6 +54,20 @@ else
 	log "NOTE: if the container cannot write to the checkout, run: chmod -R a+rwX ."
 fi
 
+# lint/go/new-code only reports lines changed since GO_LINT_NEW_CODE_BASE
+# (Makefile default: origin/main). CI checkouts are shallow and have no
+# origin/main, which makes it report the whole tree, so mirror ci.yaml:
+# PRs check out the merge commit, whose first parent is the base branch
+# tip; other events compare HEAD with itself, so the pass reports nothing.
+if [[ -z "${GO_LINT_NEW_CODE_BASE:-}" && -n "${GITHUB_ACTIONS:-}" ]]; then
+	if [[ "${GITHUB_EVENT_NAME:-}" == "pull_request" ]]; then
+		GO_LINT_NEW_CODE_BASE=HEAD^1
+	else
+		GO_LINT_NEW_CODE_BASE=HEAD
+	fi
+	export GO_LINT_NEW_CODE_BASE
+fi
+
 # Helper: run a make target inside the image.
 #
 # Mounts /home/coder/ as a single named volume to mirror the dogfood
@@ -69,6 +88,7 @@ run_make() {
 		--network=host \
 		--env GITHUB_TOKEN \
 		--env GITHUB_BASE_REF \
+		--env GO_LINT_NEW_CODE_BASE \
 		--env CI \
 		"$IMAGE" \
 		make "$@"