chore: re-vendor canonical files from prompts at dd4027b (closes #472)

Copies .dockerignore, .gitignore, .prettierignore, check.yml and
REPO_POLICIES.md from sneak/prompts at dd4027b, keeping the repo's own
entries (dist/, release/, yarn files) after the canonical content.

The Dockerfile gets separate lint and test phases; its last stage
depends on both, checks the git describe version and runs make build.
script/lint, test, check, cibuild and docker are the canonical models.
check-censored moves into the lint phase and test-verify-build into the
test phase. fmt and fmt-check fall back to the nvm-installed node. The
e2e image builds are uncached. Comments citing the old test caps or what
runs a script are updated.

Model: opus-5-5

docs/RELEASE.md

@@ -16,9 +16,9 @@ so the "release commit" throughout is the `main` commit the milestone PR merged.
 ## Procedure
 
 1. **Confirm `main` is green in CI.** The `check` workflow
-   (`.gitea/workflows/check.yml`) runs `script/cibuild`, i.e. `docker build .`,
-   and the `Dockerfile` runs `make check` as a build step, so a green `check`
-   run is a green `make check`. Find the run for the exact release commit on the
+   (`.gitea/workflows/check.yml`) runs `script/cibuild`, which runs
+   `script/check` and then builds the image uncached, so a green `check` run is
+   a green `make check`. Find the run for the exact release commit on the
    tracker's Actions view. _Check:_ that commit's `check` run succeeded; running
    `make check` on a clean checkout of the commit reproduces it and exits 0.