Re-vendor the canonical files from sneak/prompts at dd4027b (closes #13)

`.dockerignore`, `.gitignore`, `.golangci.yml` and the workflow are their
copies at that commit. This repo's own entries are kept after the
canonical content: the anchored `/attrsum` binary, the Go entries in
`.gitignore`, and tabs for `*.go` in the new `.editorconfig`.
`REPO_POLICIES.md` is new. The workflow keeps `fetch-depth: 0`, which the
policies require of a repo that stamps a tag-derived version.

The lint phase moves to golangci-lint v2.14.0. `script/bootstrap`
installs goimports with `go install` at its pinned commit unless the
installed binary already has the pinned version, read with
`go version -m`. It and `script/fmt` put Go's bin directory on `PATH`
first, since the CI runner's `PATH` lacks it.

Model: opus-5-5

script/fmt

@@ -6,6 +6,11 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
+    # script/bootstrap installs goimports into Go's bin directory, which
+    # need not be on PATH.
+    gobin="$(go env GOBIN)"
+    [ -n "$gobin" ] || gobin="$(go env GOPATH)/bin"
+    PATH="$gobin:$PATH"
     gofmt -s -w .
     goimports -w .
 }