chore: re-vendor canonical files from prompts at dd4027b (closes #472)

Copies .dockerignore, .gitignore, .prettierignore, check.yml and
REPO_POLICIES.md from sneak/prompts at dd4027b. The repo's own entries
(dist/, release/, yarn files) are kept after the canonical content.

The Dockerfile gets separate lint and test phases. Its last stage
depends on both, checks the git describe version and runs make build.
script/lint, test, check, cibuild and docker are the canonical models.
check-censored moves into the lint phase and test-verify-build into the
test phase. fmt and fmt-check fall back to the nvm-installed node. The
e2e image builds are uncached. Comments that cited the old 20-second
test cap now say 60.

Model: opus-5-5

TODO.md

@@ -45,6 +45,18 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-10-06: The canonical files are re-vendored from `sneak/prompts` at
+  `dd4027b` ([#472](https://git.eeqj.de/sneak/AutistMask/issues/472)). The
+  `Dockerfile` has separate `lint` and `test` phases, and its last stage depends
+  on both before it runs `make build`. `script/lint` and `script/test` each
+  build one phase, uncached. `script/check-censored` runs in the `lint` phase
+  and `script/test-verify-build` in the `test` phase. `script/check` runs the
+  two phases and `script/fmt-check`. `script/cibuild` bootstraps, runs
+  `script/check`, then builds the image uncached. With no version passed, the
+  image build takes one from `git describe` on the `.git` in the build context,
+  which `.dockerignore` now sends without its `config`. The vendored `check.yml`
+  has no `timeout-minutes`, so the `check` job's cap is gone.
+
 - 2026-10-05: `make dev` watches
   ([#332](https://git.eeqj.de/sneak/AutistMask/issues/332)). It used to pass
   `--watch` to a `build.js` that read no arguments, so it built once and exited.