Bring the repo up to the standard layout (closes #1)

Vendors .gitignore, .dockerignore, .editorconfig, REPO_POLICIES.md,
script/cibuild, script/docker, script/lint, script/test and the CI
workflow byte-identical from sneak/prompts commit cc440118c876; the
two ignore files then add this repo's own build output, root-anchored
so cmd/bsdaily/ stays in. The Dockerfile gains a lint phase on the
golangci-lint image already pinned and a test phase on the Debian Go
image with sqlite3 and zstd; the build stage copies a file from each,
so a plain docker build cannot skip them. Nothing installs
golangci-lint on the host.

.golangci.yml and the lint cleanup: #6

Model: opus-5-5

script/bootstrap

@@ -10,7 +10,6 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 PKGMGR=""
 SUDO=""
-APT_UPDATED=""
 
 detect_pkgmgr() {
     [ -n "$PKGMGR" ] && return 0
@@ -39,14 +38,7 @@ pkg_install() {
     detect_pkgmgr
     case "$PKGMGR" in
         nix) nix-env -iA "nixpkgs.$1" ;;
-        apt)
-            # Package lists may be empty (fresh images); refresh once per run.
-            if [ -z "$APT_UPDATED" ]; then
-                $SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
-                APT_UPDATED=1
-            fi
-            $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2"
-            ;;
+        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
         brew) brew install "$3" ;;
         apk) apk add --no-cache "$4" ;;
     esac