chore: re-vendor canonical files from prompts at dd4027b (closes #472)

Copies .dockerignore, .gitignore, .prettierignore, check.yml and
REPO_POLICIES.md from sneak/prompts at dd4027b, keeping the repo's own
entries (dist/, release/, yarn files) after the canonical content.

The Dockerfile gets separate lint and test phases; its last stage
depends on both, checks the git describe version and runs make build.
script/lint, test, check, cibuild and docker are the canonical models.
check-censored moves into the lint phase and test-verify-build into the
test phase. fmt and fmt-check fall back to the nvm-installed node. The
e2e image builds are uncached. Comments citing the old test caps or what
runs a script are updated.

Model: opus-5-5

.gitea/workflows/e2e.yml

@@ -3,7 +3,7 @@ on: [push]
 
 # The browser end-to-end suites, one job per browser, deliberately kept out
 # of the check workflow: REPO_POLICIES.md caps make test at 60 seconds and
-# script/cibuild runs make check, so folding a browser suite into either
+# script/cibuild runs script/check, so folding a browser suite into either
 # would blow that cap and slow the local fast path. Before this workflow
 # every browser-level guarantee in this repo held only when a human
 # remembered to run it.

README.md

@@ -290,10 +290,13 @@ provide:
   says so in a banner rather than passing them.
 - `script/docker` — build the Docker image, uncached and tagged via
   `script/projectname`: the `lint` and `test` phases, then `make build` in the
-  last stage. It passes the version `git describe --tags --always --dirty` gives
-  on the host; without one, the build runs `git describe` on the `.git` in the
-  build context, which `.dockerignore` sends without its `config`, and fails if
-  git cannot read it
+  last stage. It passes what `git describe --tags --always --dirty` prints on
+  the host as the `VERSION` build argument, or `unknown` when that prints
+  nothing, and the last stage fails on `unknown` whenever the build context
+  carries `.git`. Only a build given no `VERSION` at all, such as a plain
+  `docker build .`, runs `git describe` on the `.git` in the build context,
+  which `.dockerignore` sends without its `config`, and fails if git cannot read
+  it
 - `script/cibuild` — CI entrypoint: `script/bootstrap`, `script/check`, then the
   same image build as `script/docker`
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`

TODO.md

@@ -52,10 +52,11 @@ but the review is broader than any of them.
   build one phase, uncached. `script/check-censored` runs in the `lint` phase
   and `script/test-verify-build` in the `test` phase. `script/check` runs the
   two phases and `script/fmt-check`. `script/cibuild` bootstraps, runs
-  `script/check`, then builds the image uncached. With no version passed, the
-  image build takes one from `git describe` on the `.git` in the build context,
-  which `.dockerignore` now sends without its `config`. The vendored `check.yml`
-  has no `timeout-minutes`, so the `check` job's cap is gone.
+  `script/check`, then builds the image uncached. Given no `VERSION` build
+  argument, as in a plain `docker build .`, the image build takes one from
+  `git describe` on the `.git` in the build context, which `.dockerignore` now
+  sends without its `config`. The vendored `check.yml` has no `timeout-minutes`,
+  so the `check` job's cap is gone.
 
 - 2026-10-06: Reloading or closing the popup mid-refresh no longer logs the
   requests that cancels as failures