Re-vendor the canonical files from sneak/prompts at dd4027b (closes #13)

`.dockerignore`, `.gitignore`, `.golangci.yml` and the workflow are their
copies at that commit. This repo's own entries are kept after the
canonical content: the anchored `/attrsum` binary, the Go entries in
`.gitignore`, and tabs for `*.go` in the new `.editorconfig`.
`REPO_POLICIES.md` is new. The workflow keeps `fetch-depth: 0`, which the
policies require of a repo that stamps a tag-derived version.

The lint phase moves to golangci-lint v2.14.0, which finds nothing in
the code. `script/fmt` now runs goimports with `go run` at its pinned
commit. A version-checked install by `script/bootstrap` would have to be
found on `PATH`, and the CI runner's `PATH` lacks Go's bin directory.

Model: opus-5-5

TODO.md

@@ -17,14 +17,20 @@ have landed since the tag.
 
 # Next Step
 
-Re-vendor the canonical files from `sneak/prompts` at `dd4027b`
-(https://git.eeqj.de/sneak/attrsum/issues/13): add `REPO_POLICIES.md`
-and `.editorconfig`, refresh `.gitignore` (only the `attrsum` binary
-today), `.dockerignore`, `.gitea/workflows/check.yml` and
-`.golangci.yml`, and move the lint phase to golangci-lint v2.14.0.
+Restructure README.md into the standard sections: Description, Getting
+Started, Entrypoints, Rationale, Design, TODO, License, Author (Getting
+Started, Why?, TODO, License exist; Description, Entrypoints, Design,
+Author are missing)
 
 # Completed Steps
 
+* 2026-10-06: canonical files re-vendored from `sneak/prompts` at
+    `dd4027b`: `REPO_POLICIES.md` and `.editorconfig` added;
+    `.dockerignore`, `.gitignore`, `.golangci.yml` and the workflow
+    refreshed, keeping this repo's own entries and `fetch-depth: 0`;
+    the lint phase runs golangci-lint v2.14.0; `script/fmt` runs
+    goimports with `go run` at its pinned commit instead of
+    `script/bootstrap` installing it
 * 2026-10-06: a path that `--exclude` or `--exclude-dotfiles` excludes
     is skipped even when it cannot be read, so an excluded directory
     that cannot be listed no longer fails the run
@@ -62,10 +68,6 @@ today), `.dockerignore`, `.gitea/workflows/check.yml` and
 
 # Future Steps
 
-* Restructure README.md into the standard sections: Description,
-    Getting Started, Entrypoints, Rationale, Design, TODO, License,
-    Author (Getting Started, Why?, TODO, License exist; Description,
-    Entrypoints, Design, Author are missing)
 * Add a `LICENSE` file matching the README's WTFPL v2; sneak's to add,
     not an agent's
 * Tag a patch release to ship the 2026-02-02 correctness fixes