chore: re-vendor canonical files from prompts at dd4027b (closes #472)

Copies .dockerignore, .gitignore, .prettierignore, check.yml and
REPO_POLICIES.md from sneak/prompts at dd4027b, keeping the repo's own
entries (dist/, release/, yarn files) after the canonical content.

The Dockerfile gets separate lint and test phases; its last stage
depends on both, checks the git describe version and runs make build.
script/lint, test, check, cibuild and docker are the canonical models.
check-censored moves into the lint phase and test-verify-build into the
test phase. fmt and fmt-check fall back to the nvm-installed node. The
e2e image builds are uncached. Comments citing the old test caps or what
runs a script are updated.

Model: opus-5-5

tests/phishingDomains.test.js

@@ -45,9 +45,9 @@ describe("vendored blocklist", () => {
         // than loudly, so the ordering the search depends on is asserted here
         // against the committed file rather than assumed of the generator.
         // One assertion at the end rather than one per entry: 100k+ expect()
-        // calls cost seconds, and make test is capped at 30 for the whole
-        // suite. The index of the first offender is reported, so a failure
-        // still says where.
+        // calls cost seconds, and make test is capped at 60 seconds for the
+        // whole suite. The index of the first offender is reported, so a
+        // failure still says where.
         let previous = "";
         let outOfOrderAt = -1;
         for (let i = 0; i < vendored.count; i++) {