chore: repo policy compliance sweep — test rerun, npx, frozen lockfile, docs (closes #166)

- script/test runs the suite quietly, then reruns it with --verbose on
  failure and always exits 1 (REPO_POLICIES.md conditional verbose rerun
  pattern). New package.json script test:verbose is the -v form of the
  existing jest --forceExit invocation.
- build.js calls node_modules/.bin/tailwindcss instead of npx, which
  would fetch from the registry unpinned if the binary were absent.
- make install uses --frozen-lockfile, so a stale yarn.lock fails the
  target instead of being silently rewritten.
- README Getting Started uses make setup (which also installs the
  pre-commit hook); the Makefile-only targets (install, hooks, build,
  build-debug, clean, dev) are now documented in Entrypoints.
- .dockerignore records why .git is deliberately not excluded.

build.js

@@ -115,8 +115,17 @@ async function build() {
     // build that never gets around to writing one cannot be verified against
     // a stale list.
     fs.rmSync(BUNDLE_MANIFEST, { force: true });
+    // The locally installed binary, not `npx` — npx silently fetches from the
+    // registry when the binary is absent, which is an unpinned network fetch
+    // in the middle of a build.
+    const tailwindBin = path.join(
+        __dirname,
+        "node_modules",
+        ".bin",
+        "tailwindcss",
+    );
     execSync(
-        `npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`,
+        `"${tailwindBin}" -i "${tailwindInput}" -o "${tailwindOutput}" --minify`,
         { stdio: "inherit" },
     );