Bring the repo up to the standard layout (closes #1)

Adds the canonical .gitignore, .dockerignore and .editorconfig; the
first two also name this repo's build output, root-anchored so
cmd/bsdaily/ stays in. The Dockerfile gains a lint phase on the
golangci-lint image already pinned and a test phase on the Debian Go
image with sqlite3 and zstd; the build stage copies a file from each,
so a plain docker build cannot skip them. script/lint and script/test
build their phase uncached and tagged; script/cibuild, script/docker
and the CI workflow are the canonical copies. Nothing installs
golangci-lint on the host. REPO_POLICIES.md is re-vendored.

.golangci.yml and the lint cleanup: #6
Judgement call: .gitignore adds Go build output, per the Go styleguide.

Model: opus-5-5

TODO.md

@@ -14,12 +14,17 @@ pre-1.0
 
 # Next Step
 
-Bring the repo into policy compliance in one commit: add .gitignore,
-.dockerignore, .editorconfig, and .golangci.yml. Verify `make check` stays
-green with the new lint config.
+Add the canonical `.golangci.yml`, move the lint phase to golangci-lint
+v2.14.0 in the same commit, and fix the findings it surfaces
+(https://git.eeqj.de/sneak/bsdaily/issues/6).
 
 # Completed Steps
 
+- 2026-10-05: Brought the repo up to the standard layout: canonical
+  `.gitignore`, `.dockerignore` and `.editorconfig`; `lint` and `test`
+  phases in the `Dockerfile`, built by `script/lint` and `script/test`;
+  canonical `script/cibuild`, `script/docker` and CI workflow; no linter
+  installed on the host; re-vendored `REPO_POLICIES.md`.
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-06-28: Fixed errcheck lint failures; added compilation smoke test;
@@ -36,8 +41,8 @@ green with the new lint config.
 
 # Future Steps
 
-- Add .gitignore, .dockerignore, .editorconfig, .golangci.yml (the Next
-  Step).
+- Format Markdown with prettier in `script/fmt` and `script/fmt-check`
+  (https://git.eeqj.de/sneak/bsdaily/issues/7).
 - Expand tests beyond the compilation smoke test: unit tests for the
   extraction, verification, and atomic-publish paths.
 - Cut a first SemVer release once compliance and test coverage land.