[WIP] ci(lint): verify machine objects

Adapted from
freedomofpress/securedrop-client#6fcd4ddc4ac6aaf034aa841bbd5651c8ac703737.
Here we do treat "make verify-mo" as a linter, to avoid running it (over
n languages) n times in each of n "translation-tests" jobs.

.circleci/config.yml

@@ -94,6 +94,13 @@ jobs:
             DOCKER_BUILD_ARGUMENTS="--cache-from securedrop-test-focal-py3:${fromtag:-latest}" securedrop/bin/dev-shell \
                   bash -c "/opt/venvs/securedrop-app-code/bin/pip3 install --require-hashes -r requirements/python3/develop-requirements.txt && make -C .. lint"
 
+      - run:
+          name: Check that translation machine objects are reproducible
+          command: |
+            fromtag=$(docker images |grep securedrop-test-focal-py3 |head -n1 |awk '{print $2}')
+            DOCKER_BUILD_ARGUMENTS="--cache-from securedrop-test-focal-py3:${fromtag:-latest}" securedrop/bin/dev-shell \
+                  bash -c "/opt/venvs/securedrop-app-code/bin/pip3 install --require-hashes -r requirements/python3/develop-requirements.txt && make -C .. verify-mo"
+
   rust:
     # Keep version in sync with rust-toolchain.toml
     docker: