chore: re-vendor canonical files from prompts at dd4027b (closes #472)

Copies .dockerignore, .gitignore, .prettierignore, check.yml and
REPO_POLICIES.md from sneak/prompts at dd4027b, keeping the repo's own
entries (dist/, release/, yarn files) after the canonical content.

The Dockerfile gets separate lint and test phases; its last stage
depends on both, checks the git describe version and runs make build.
script/lint, test, check, cibuild and docker are the canonical models.
check-censored moves into the lint phase and test-verify-build into the
test phase. fmt and fmt-check fall back to the nvm-installed node. The
e2e image builds are uncached. Comments citing the old test caps or what
runs a script are updated.

Model: opus-5-5

tests/e2e/run.js

@@ -4,7 +4,7 @@
 //
 // A plain runner rather than jest on purpose: jest's default testMatch
 // would pull these files into script/test, and browser tests do not fit
-// inside the 20-second cap REPO_POLICIES.md puts on make test. Nothing
+// inside the 60-second cap REPO_POLICIES.md puts on make test. Nothing
 // here is named *.test.js for the same reason.
 
 "use strict";