Re-vendor the canonical files from sneak/prompts at dd4027b (closes #13)

`.dockerignore`, `.gitignore`, `.golangci.yml` and the workflow are their
copies at that commit. This repo's own entries are kept after the
canonical content: the anchored `/attrsum` binary, the Go entries in
`.gitignore`, and tabs for `*.go` in the new `.editorconfig`.
`REPO_POLICIES.md` is new. The workflow keeps `fetch-depth: 0`, which the
policies require of a repo that stamps a tag-derived version.

The lint phase moves to golangci-lint v2.14.0. `script/bootstrap`
installs goimports with `go install` at its pinned commit unless the
installed binary already has the pinned version, read with
`go version -m`. It and `script/fmt` put Go's bin directory on `PATH`
first, since the CI runner's `PATH` lacks it.

Model: opus-5-5

TODO.md

@@ -28,9 +28,9 @@ Author are missing)
     `dd4027b`: `REPO_POLICIES.md` and `.editorconfig` added;
     `.dockerignore`, `.gitignore`, `.golangci.yml` and the workflow
     refreshed, keeping this repo's own entries and `fetch-depth: 0`;
-    the lint phase runs golangci-lint v2.14.0; `script/fmt` runs
+    the lint phase runs golangci-lint v2.14.0; `script/bootstrap`
-    goimports with `go run` at its pinned commit instead of
+    installs goimports unless the installed one has the pinned version,
-    `script/bootstrap` installing it
+    and it and `script/fmt` put Go's bin directory on `PATH`
 * 2026-10-06: the summary line after `sum`, `check` and `clear` prints
     the byte unit once (`1.5 KiB`, not `1.5 KiB bytes`)
 * 2026-10-06: a path that `--exclude` or `--exclude-dotfiles` excludes

script/bootstrap

@@ -3,13 +3,19 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes nothing is present.
-# goimports is not installed: script/fmt runs it with `go run` at a
+# goimports is installed via `go install` at a pinned commit (never
-# pinned commit. The linter is not installed: it runs only as the lint
+# "latest"), unless the installed one already has the pinned version.
-# phase of the Dockerfile.
+# The linter is not installed: it runs only as the lint phase of the
+# Dockerfile.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Pinned versions, 2026-10-05
+# GOIMPORTS_REF is the commit tagged GOIMPORTS_VERSION.
+GOIMPORTS_VERSION="v0.42.0"
+GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
+
 PKGMGR=""
 SUDO=""
 APT_UPDATED=""
@@ -57,6 +63,30 @@ missing() {
     ! command -v "$1" >/dev/null 2>&1
 }
 
+# Print the version the goimports on PATH was built from, or nothing.
+# goimports has no version flag; `go version -m` reads the binary's
+# build info, whose "mod" line names the module and its version.
+goimports_version() {
+    if missing goimports; then return 0; fi
+    go version -m "$(command -v goimports)" 2>/dev/null |
+        awk '$1 == "mod" { print $3 }'
+}
+
+ensure_goimports() {
+    if [ "$(goimports_version)" = "$GOIMPORTS_VERSION" ]; then
+        echo "goimports $GOIMPORTS_VERSION already installed"
+        return 0
+    fi
+    go install "$GOIMPORTS_REF"
+    hash -r
+    if [ "$(goimports_version)" != "$GOIMPORTS_VERSION" ]; then
+        echo "bootstrap: goimports on PATH is not $GOIMPORTS_VERSION:" \
+            "$(command -v goimports)" >&2
+        exit 1
+    fi
+    echo "goimports $GOIMPORTS_VERSION installed"
+}
+
 main() {
     cd "$ROOT"
 
@@ -64,6 +94,12 @@ main() {
     if missing make; then pkg_install gnumake make make make; fi
     if missing go; then pkg_install go golang go go; fi
 
+    # go install writes to Go's bin directory, which need not be on PATH.
+    gobin="$(go env GOBIN)"
+    [ -n "$gobin" ] || gobin="$(go env GOPATH)/bin"
+    PATH="$gobin:$PATH"
+    ensure_goimports
+
     go mod download
 
     echo "bootstrap complete"

script/fmt

@@ -4,14 +4,15 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# goimports v0.42.0, 2026-10-05. Run with `go run` at this commit rather
-# than installed, so it is always this version, whatever is on PATH.
-GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
-
 main() {
     cd "$ROOT"
+    # script/bootstrap installs goimports into Go's bin directory, which
+    # need not be on PATH.
+    gobin="$(go env GOBIN)"
+    [ -n "$gobin" ] || gobin="$(go env GOPATH)/bin"
+    PATH="$gobin:$PATH"
     gofmt -s -w .
-    go run "$GOIMPORTS_REF" -w .
+    goimports -w .
 }
 
 main "$@"