chore: re-vendor canonical files from prompts at dd4027b (closes #472)

Copies .dockerignore, .gitignore, .prettierignore, check.yml and
REPO_POLICIES.md from sneak/prompts at dd4027b. The repo's own entries
(dist/, release/, yarn files) are kept after the canonical content.

The Dockerfile gets separate lint and test phases. Its last stage
depends on both, checks the git describe version and runs make build.
script/lint, test, check, cibuild and docker are the canonical models.
check-censored moves into the lint phase and test-verify-build into the
test phase. fmt and fmt-check fall back to the nvm-installed node. The
e2e image builds are uncached. Comments that cited the old test caps
now say 60 seconds, and comments that named what runs a script now name
the Dockerfile phase or stage.

Model: opus-5-5

.gitea/workflows/e2e.yml

@@ -3,7 +3,7 @@ on: [push]
 
 # The browser end-to-end suites, one job per browser, deliberately kept out
 # of the check workflow: REPO_POLICIES.md caps make test at 60 seconds and
-# script/cibuild runs script/check, so folding a browser suite into either
+# script/cibuild runs make check, so folding a browser suite into either
 # would blow that cap and slow the local fast path. Before this workflow
 # every browser-level guarantee in this repo held only when a human
 # remembered to run it.

README.md

@@ -290,13 +290,10 @@ provide:
   says so in a banner rather than passing them.
 - `script/docker` — build the Docker image, uncached and tagged via
   `script/projectname`: the `lint` and `test` phases, then `make build` in the
-  last stage. It passes what `git describe --tags --always --dirty` prints on
-  the host as the `VERSION` build argument, or `unknown` when that prints
-  nothing, and the last stage fails on `unknown` whenever the build context
-  carries `.git`. Only a build given no `VERSION` at all, such as a plain
-  `docker build .`, runs `git describe` on the `.git` in the build context,
-  which `.dockerignore` sends without its `config`, and fails if git cannot read
-  it
+  last stage. It passes the version `git describe --tags --always --dirty` gives
+  on the host; without one, the build runs `git describe` on the `.git` in the
+  build context, which `.dockerignore` sends without its `config`, and fails if
+  git cannot read it
 - `script/cibuild` — CI entrypoint: `script/bootstrap`, `script/check`, then the
   same image build as `script/docker`
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`

TODO.md

@@ -52,11 +52,10 @@ but the review is broader than any of them.
   build one phase, uncached. `script/check-censored` runs in the `lint` phase
   and `script/test-verify-build` in the `test` phase. `script/check` runs the
   two phases and `script/fmt-check`. `script/cibuild` bootstraps, runs
-  `script/check`, then builds the image uncached. Given no `VERSION` build
-  argument, as in a plain `docker build .`, the image build takes one from
-  `git describe` on the `.git` in the build context, which `.dockerignore` now
-  sends without its `config`. The vendored `check.yml` has no `timeout-minutes`,
-  so the `check` job's cap is gone.
+  `script/check`, then builds the image uncached. With no version passed, the
+  image build takes one from `git describe` on the `.git` in the build context,
+  which `.dockerignore` now sends without its `config`. The vendored `check.yml`
+  has no `timeout-minutes`, so the `check` job's cap is gone.
 
 - 2026-10-06: Reloading or closing the popup mid-refresh no longer logs the
   requests that cancels as failures