chore: re-vendor canonical files from prompts at dd4027b (closes #472)

Copies .dockerignore, .gitignore, .prettierignore, check.yml and
REPO_POLICIES.md from sneak/prompts at dd4027b. The repo's own entries
(dist/, release/, yarn files) are kept after the canonical content.

The Dockerfile gets separate lint and test phases. Its last stage
depends on both, checks the git describe version and runs make build.
script/lint, test, check, cibuild and docker are the canonical models.
check-censored moves into the lint phase and test-verify-build into the
test phase. fmt and fmt-check fall back to the nvm-installed node. The
e2e image builds are uncached. Comments that cited the old 20-second
test cap now say 60.

Model: opus-5-5

script/check-censored

@@ -1,8 +1,8 @@
 #!/bin/sh
 # script/check-censored: assert that the competitor name RULES.md bars appears
 # nowhere in this repo, and nowhere in the built extension, except where it is
-# deliberate. Our own extension to scripts-to-rule-them-all, run by the
+# deliberate. Our own extension to scripts-to-rule-them-all, run from
-# Dockerfile's lint phase and by make build.
+# script/check and from make build.
 #
 # Where the name is allowed, and why each one is not negotiable away:
 #

script/lib/eslint/noStateSingletonInBackground.js

@@ -14,7 +14,7 @@
 // the build when esbuild's own metafile reports src/shared/state.js as an input
 // of a background bundle. That consults the resolution esbuild actually
 // performed, so no specifier syntax and no resolution rule can slip past it,
-// and the Dockerfile's last stage runs `make build` in CI.
+// and Dockerfile:42 runs `make build` in CI.
 //
 // What this rule is: fast local feedback, in the editor and in `make lint`,
 // before a full bundle. It reads sources from disk and matches import

script/test-verify-build

@@ -2,8 +2,7 @@
 # script/test-verify-build: exercise every failure mode of
 # script/verify-build, and what make build does with dist/ after one of them
 # (script/discard-dist-on-failure). Our own extension to
-# scripts-to-rule-them-all, run by the Dockerfile's test phase so make check
+# scripts-to-rule-them-all, run from script/check so make check covers it.
-# covers it.
 #
 # Why this exists: verify-build is the build-integrity guard, and four separate
 # reviews of it each found a fresh vacuous pass — the grep exit-2 conflation,

tests/phishingDomains.test.js

@@ -45,9 +45,9 @@ describe("vendored blocklist", () => {
         // than loudly, so the ordering the search depends on is asserted here
         // against the committed file rather than assumed of the generator.
         // One assertion at the end rather than one per entry: 100k+ expect()
-        // calls cost seconds, and make test is capped at 60 seconds for the
+        // calls cost seconds, and make test is capped at 30 for the whole
-        // whole suite. The index of the first offender is reported, so a
+        // suite. The index of the first offender is reported, so a failure
-        // failure still says where.
+        // still says where.
         let previous = "";
         let outOfOrderAt = -1;
         for (let i = 0; i < vendored.count; i++) {