chore: re-vendor canonical files from prompts at dd4027b (closes #472)

Copies .dockerignore, .gitignore, .prettierignore, check.yml and
REPO_POLICIES.md from sneak/prompts at dd4027b. The repo's own entries
(dist/, release/, yarn files) are kept after the canonical content.

The Dockerfile gets separate lint and test phases. Its last stage
depends on both, checks the git describe version and runs make build.
script/lint, test, check, cibuild and docker are the canonical models.
check-censored moves into the lint phase and test-verify-build into the
test phase. fmt and fmt-check fall back to the nvm-installed node. The
e2e image builds are uncached. Comments that cited the old test caps
now say 60 seconds, and comments that named what runs a script now name
the Dockerfile phase or stage.

Model: opus-5-5

tests/e2e/firefox/run.js

@@ -8,7 +8,7 @@
 //   node tests/e2e/firefox/run.js [dist/firefox]
 //
 // Deliberately not part of script/check, and deliberately not named
-// *.test.js: REPO_POLICIES.md caps make test at 20 seconds and a browser
+// *.test.js: REPO_POLICIES.md caps make test at 60 seconds and a browser
 // suite does not fit.
 //
 // This shares no driver layer with the Chrome suite in tests/e2e/, and the

tests/e2e/harness.js

@@ -4,7 +4,7 @@
 //
 // This runs inside the pinned Playwright container; see script/test-e2e.
 // It is deliberately NOT part of make check — REPO_POLICIES.md caps
-// make test at 20 seconds and a browser suite does not fit.
+// make test at 60 seconds and a browser suite does not fit.
 
 "use strict";
 

tests/e2e/run.js

@@ -4,7 +4,7 @@
 //
 // A plain runner rather than jest on purpose: jest's default testMatch
 // would pull these files into script/test, and browser tests do not fit
-// inside the 20-second cap REPO_POLICIES.md puts on make test. Nothing
+// inside the 60-second cap REPO_POLICIES.md puts on make test. Nothing
 // here is named *.test.js for the same reason.
 
 "use strict";