chore: re-vendor canonical files from prompts at dd4027b (closes #472)

Copies .dockerignore, .gitignore, .prettierignore, check.yml and
REPO_POLICIES.md from sneak/prompts at dd4027b, keeping the repo's own
entries (dist/, release/, yarn files) after the canonical content.

The Dockerfile gets separate lint and test phases; its last stage
depends on both, checks the git describe version and runs make build.
script/lint, test, check, cibuild and docker are the canonical models.
check-censored moves into the lint phase and test-verify-build into the
test phase. fmt and fmt-check fall back to the nvm-installed node. The
e2e image builds are uncached. Comments citing the old test caps or what
runs a script are updated.

Model: opus-5-5

tests/vault.test.js

@@ -12,8 +12,8 @@
 // interactive parameters, which the module hardcodes. The parameters are not
 // weakened or overridden anywhere in this file — they are pinned by the "key
 // derivation cost" tests, since they are the vault's only defence against an
-// offline attack on a stolen blob. The suite is kept inside script/test's
-// 30-second budget by sharing one encrypted fixture across the tamper cases
+// offline attack on a stolen blob. The suite is kept inside the 60-second
+// make test cap by sharing one encrypted fixture across the tamper cases
 // instead of re-encrypting per test.
 
 const sodium = require("libsodium-wrappers-sumo");