build: re-vendor canonical files from prompts dd4027b (closes #257)

The canonical files are fetched whole from sneak/prompts at dd4027b;
.golangci.yml keeps the livednstest deny entry and .dockerignore adds
/bin. Lint and test are phases of the Dockerfile (golangci-lint
v2.14.0; tests on the Debian Go 1.25.7 image with the same flags), and
the build stage depends on both and stamps the version the canonical
way. Dockerfile.lint is gone; the prettier stages of Dockerfile.fmt
moved into the Dockerfile, so Markdown formatting still runs in Docker.
Every scripted docker build passes --no-cache; script/cibuild
bootstraps, runs script/check, then builds the image. script/fmt-check
absorbs fmt-check-go and fmt-check-markdown. The canonical .gitignore
has no bin/ entry. The new linter raised no findings.

Model: opus-5-5

Makefile

@@ -2,9 +2,9 @@
 
 BINARY := dnswatcher
 # VERSION given on the command line (`make build VERSION=...`) or in the
-# environment, which is how the Dockerfile's VERSION build arg arrives,
-# wins over what `git describe` says of this checkout. An empty one counts
-# as not given; `override` is what replaces an empty command-line value.
+# environment wins over what `git describe` says of this checkout. An
+# empty one counts as not given; `override` is what replaces an empty
+# command-line value.
 ifeq ($(VERSION),)
 override VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
 endif
@@ -25,7 +25,7 @@ setup:
 build:
 	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/dnswatcher
 
-# Prints the version `make build` stamps; the Dockerfile checks it.
+# Prints the version `make build` stamps.
 version:
 	@echo "$(VERSION)"