Re-vendor the canonical files from sneak/prompts at dd4027b (closes #13)

`.dockerignore`, `.gitignore`, `.golangci.yml` and the workflow are their
copies at that commit. This repo's own entries are kept after the
canonical content: the anchored `/attrsum` binary, the Go entries in
`.gitignore`, and tabs for `*.go` in the new `.editorconfig`.
`REPO_POLICIES.md` is new. The workflow keeps `fetch-depth: 0`, which the
policies require of a repo that stamps a tag-derived version.

The lint phase moves to golangci-lint v2.14.0, which finds nothing in
the code. `script/fmt` now runs goimports with `go run` at its pinned
commit. A version-checked install by `script/bootstrap` would have to be
found on `PATH`, and the CI runner's `PATH` lacks Go's bin directory.

Model: opus-5-5

script/bootstrap

@@ -3,17 +3,13 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes nothing is present.
-# goimports is installed via `go install` at a pinned commit (never
-# "latest"). The linter is not installed: it runs only as the lint phase
-# of the Dockerfile.
+# goimports is not installed: script/fmt runs it with `go run` at a
+# pinned commit. The linter is not installed: it runs only as the lint
+# phase of the Dockerfile.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Pinned versions, 2026-10-05
-# goimports v0.42.0
-GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
-
 PKGMGR=""
 SUDO=""
 APT_UPDATED=""
@@ -68,10 +64,6 @@ main() {
     if missing make; then pkg_install gnumake make make make; fi
     if missing go; then pkg_install go golang go go; fi
 
-    # Format tool, pinned via go install (installs into
-    # "$(go env GOPATH)/bin"; ensure that is on your PATH).
-    if missing goimports; then go install "$GOIMPORTS_REF"; fi
-
     go mod download
 
     echo "bootstrap complete"

script/fmt

@@ -4,10 +4,14 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# goimports v0.42.0, 2026-10-05. Run with `go run` at this commit rather
+# than installed, so it is always this version, whatever is on PATH.
+GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
+
 main() {
     cd "$ROOT"
     gofmt -s -w .
-    goimports -w .
+    go run "$GOIMPORTS_REF" -w .
 }
 
 main "$@"