chore: re-vendor canonical files from prompts at dd4027b (closes #472)

Copies .dockerignore, .gitignore, .prettierignore, check.yml and
REPO_POLICIES.md from sneak/prompts at dd4027b, keeping the repo's own
entries (dist/, release/, yarn files) after the canonical content.

The Dockerfile gets separate lint and test phases; its last stage
depends on both, checks the git describe version and runs make build.
script/lint, test, check, cibuild and docker are the canonical models.
check-censored moves into the lint phase and test-verify-build into the
test phase. fmt and fmt-check fall back to the nvm-installed node. The
e2e image builds are uncached. Comments citing the old test caps or what
runs a script are updated.

Model: opus-5-5

script/test-e2e

@@ -4,7 +4,7 @@
 # scripts-to-rule-them-all.
 #
 # Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
-# caps make test at 20 seconds and a browser suite does not fit. Run it
+# caps make test at 60 seconds and a browser suite does not fit. Run it
 # yourself before touching popup views. ESLint's no-undef now catches a
 # used-but-not-imported identifier in make check, but only this suite sees
 # what a view actually does when it runs.
@@ -45,7 +45,10 @@ main() {
     trap 'cleanup; exit 130' INT TERM
 
     echo "Building the Chrome e2e image (extension included)..."
-    docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
+    # --no-cache: the image build runs make build and its checks, and a
+    # cached layer is a check that did not run.
+    docker build --no-cache --iidfile "$IIDFILE" -t "$IMAGE" \
+        -f tests/e2e/Dockerfile .
 
     echo "Running e2e suite in the pinned Playwright container..."
     # The image is run by ID, not by tag: where two clones of this repo run