build: add lint target

ober

e407c82455924fa905fa058c211c21d2134fcaec

diff --git a/Makefile b/Makefile
index 2a35ad0..346168d 100644
--- a/Makefile
+++ b/Makefile
@@ -19,7 +19,7 @@ REPRO_DIR ?= dist/reproducibility
 SOAK_DIR ?= dist/soak
 BINARY_SMOKE_DIR ?= dist/binary-smoke
 
-.PHONY: all help build binary keygen agent collector analyze test security audit verify sbom reproducibility-report soak-evidence binary-smoke sanitize-evidence release-evidence install clean toolchain-check ensure-jsqlite
+.PHONY: all help build binary keygen agent collector analyze test security audit verify sbom reproducibility-report soak-evidence binary-smoke sanitize-evidence release-evidence install clean toolchain-check ensure-jsqlite lint
 .DEFAULT_GOAL := help
 
 all: binary
@@ -102,6 +102,11 @@ audit: toolchain-check
 
 verify: security test audit binary
 
+# The release gates key off a locked jerbuild hash (toolchain-check); lint runs a
+# pure admission-control check straight through the bundled jerbuild instead.
+lint:
+	$(JEXEC) tests/limits-test.ss
+
 sbom: toolchain-check
 	JERBUILD="$(JERBUILD)" JSECMONLIB_SBOM_DIR="$(SBOM_DIR)" scripts/sbom.sh