Bring the repo up to the standard layout (closes #1)

Vendors .gitignore, .dockerignore, .editorconfig, REPO_POLICIES.md,
script/cibuild, script/docker, script/lint, script/test and the CI
workflow byte-identical from sneak/prompts commit cc440118c876; the
two ignore files then add this repo's own build output, root-anchored
so cmd/bsdaily/ stays in. The Dockerfile gains a lint phase on the
golangci-lint image already pinned and a test phase on the Debian Go
image with sqlite3 and zstd; the build stage copies a file from each,
so a plain docker build cannot skip them. Nothing installs
golangci-lint on the host. On apt, script/bootstrap refreshes the
package lists once before its first install.

.golangci.yml and the lint cleanup: #6

Model: opus-5-5

TODO.md

@@ -14,12 +14,17 @@ pre-1.0
 
 # Next Step
 
-Bring the repo into policy compliance in one commit: add .gitignore,
-.dockerignore, .editorconfig, and .golangci.yml. Verify `make check` stays
-green with the new lint config.
+Add the canonical `.golangci.yml`, move the lint phase to golangci-lint
+v2.14.0 in the same commit, and fix the findings it surfaces
+(https://git.eeqj.de/sneak/bsdaily/issues/6).
 
 # Completed Steps
 
+- 2026-10-05: Brought the repo up to the standard layout: canonical
+  `.gitignore`, `.dockerignore` and `.editorconfig`; `lint` and `test`
+  phases in the `Dockerfile`, built by `script/lint` and `script/test`;
+  canonical `script/cibuild`, `script/docker` and CI workflow; no linter
+  installed on the host; re-vendored `REPO_POLICIES.md`.
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-06-28: Fixed errcheck lint failures; added compilation smoke test;
@@ -36,8 +41,8 @@ green with the new lint config.
 
 # Future Steps
 
-- Add .gitignore, .dockerignore, .editorconfig, .golangci.yml (the Next
-  Step).
+- Format Markdown with prettier in `script/fmt` and `script/fmt-check`
+  (https://git.eeqj.de/sneak/bsdaily/issues/7).
 - Expand tests beyond the compilation smoke test: unit tests for the
   extraction, verification, and atomic-publish paths.
 - Cut a first SemVer release once compliance and test coverage land.