Bring the repo up to the standard layout (closes #1)

Adds the canonical .gitignore, .dockerignore and .editorconfig; the
first two also name this repo's build output, root-anchored so
cmd/bsdaily/ stays in. The Dockerfile gains a lint phase on the
golangci-lint image already pinned and a test phase on the Debian Go
image with sqlite3 and zstd; the build stage copies a file from each,
so a plain docker build cannot skip them. script/lint and script/test
build their phase uncached and tagged; script/cibuild, script/docker
and the CI workflow are the canonical copies. Nothing installs
golangci-lint on the host. REPO_POLICIES.md is re-vendored.

.golangci.yml and the lint cleanup: #6
Judgement call: .gitignore adds Go build output, per the Go styleguide.

Model: opus-5-5

README.md

@@ -53,27 +53,34 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call
 them. We provide:
 
-- `script/bootstrap` — install all development dependencies (go,
-  golangci-lint, Go module download)
+- `script/bootstrap` — install all development dependencies (go, Go
+  module download); the linter is not installed on the host
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — print the project name (used for the Docker
-  image tag)
-- `script/test` — run the test suite (verbose rerun on failure)
-- `script/lint` — run `golangci-lint run ./...`
-- `script/fmt` — format all code (writes)
-- `script/fmt-check` — check formatting (read-only)
+  image tags)
+- `script/test` — build the Dockerfile's `test` phase, which runs the
+  test suite with `-race` (verbose rerun on failure)
+- `script/lint` — build the Dockerfile's `lint` phase, which runs
+  `golangci-lint run ./...`
+- `script/fmt` — format the Go code with `go fmt` (writes)
+- `script/fmt-check` — check the Go formatting with `gofmt` (read-only)
 - `script/check` — run `script/test`, `script/lint`, and
   `script/fmt-check`
 - `script/docker` — build the Docker image tagged via
+  `script/projectname`; the build runs the `lint` and `test` phases
+  first
+- `script/cibuild` — CI entrypoint: runs `script/bootstrap` and
+  `script/check`, then builds the Docker image tagged via
   `script/projectname`
-- `script/cibuild` — CI entrypoint: `docker build .` (the Dockerfile
-  runs the checks)
-- `script/precommit` — pre-commit gate: `go mod tidy` + `go fmt` (must
-  not change files), then `script/check`
+- `script/precommit` — pre-commit gate: `go mod tidy` (must not change
+  `go.mod` or `go.sum`) and `go fmt`, then `script/check`
 - `script/install-precommit` — install the git pre-commit hook that
   runs `script/precommit`
 
+Every Docker build in `script/` is uncached, so the `lint` and `test`
+phases always run rather than being served from the build cache.
+
 # Problem Statement
 
 A Bluesky firehose ingester writes every observed post (and associated