Bring the repo up to the standard layout (closes #1)

Adds the canonical .gitignore, .dockerignore and .editorconfig; the
first two also name this repo's build output, root-anchored so
cmd/bsdaily/ stays in. The Dockerfile gains a lint phase on the
golangci-lint image already pinned and a test phase on the Debian Go
image with sqlite3 and zstd; the build stage copies a file from each,
so a plain docker build cannot skip them. script/lint and script/test
build their phase uncached and tagged; script/cibuild, script/docker
and the CI workflow are the canonical copies. Nothing installs
golangci-lint on the host. REPO_POLICIES.md is re-vendored.

.golangci.yml and the lint cleanup: #6
Judgement call: .gitignore adds Go build output, per the Go styleguide.

Model: opus-5-5

.dockerignore

@@ -71,7 +71,9 @@
 **/.vscode
 **/*.sublime-*
 
-# This repo's host-built artifacts: `make` and `make test-coverage`.
+# This repo's host-built artifacts: `make`, `go test -c` and
+# `make test-coverage`.
 /bsdaily
+/*.test
 /coverage.out
 /coverage.html

Dockerfile

@@ -1,7 +1,7 @@
 # Lint phase. The linter is invoked directly rather than through `make
 # lint` or `script/lint`, which are themselves a docker build and would
 # recurse into a daemon that does not exist in a build step.
-# golangci/golangci-lint:v2.12.2-alpine
+# golangci/golangci-lint:v2.12.2-alpine, 2026-06-28
 FROM golangci/golangci-lint:v2.12.2-alpine@sha256:91b27804074a0bacea298707f016911e60cf0cdbc6c7bf5ccacb5f0606d18d60 AS lint
 
 WORKDIR /src
@@ -41,7 +41,7 @@ RUN go test -timeout 90s -race -cover ./... || \
 # are what make BuildKit build them first, so this stage cannot run
 # unless lint and test passed. A plain `docker build .` builds only the
 # last stage and what it depends on, so the runtime stage stays last.
-# golang:1.26.4-alpine
+# golang:1.26.4-alpine, 2026-06-28
 FROM golang:1.26.4-alpine@sha256:3ad57304ad93bbec8548a0437ad9e06a455660655d9af011d58b993f6f615648 AS builder
 
 COPY --from=lint /src/go.sum /dev/null
@@ -62,7 +62,7 @@ COPY . .
 RUN CGO_ENABLED=0 go build -o /bsdaily ./cmd/bsdaily
 
 # Runtime stage
-# alpine:3.21
+# alpine:3.21, 2026-06-28
 FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
 
 # bsdaily shells out to sqlite3, zstdmt, zstdcat at runtime