build: re-vendor canonical files from prompts dd4027b (closes #257)

The canonical files are fetched whole from sneak/prompts at dd4027b;
.golangci.yml keeps the livednstest deny entry and .dockerignore adds
/bin. Lint and test are phases of the Dockerfile (golangci-lint
v2.14.0; tests on the Debian Go 1.25.7 image with the same flags), and
the build stage depends on both and stamps the version the canonical
way. Dockerfile.lint is gone; the prettier stages of Dockerfile.fmt
moved into the Dockerfile, so Markdown formatting still runs in Docker.
Every scripted docker build passes --no-cache; script/cibuild
bootstraps, runs script/check, then builds the image. script/fmt-check
absorbs fmt-check-go and fmt-check-markdown. The canonical .gitignore
has no bin/ entry. The new linter raised no findings.

Model: opus-5-5

script/bootstrap

@@ -3,12 +3,12 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes nothing is present.
-# goimports is not installed here: script/fmt and script/fmt-check-go
-# run it with `go run` at a pinned commit.
+# goimports is not installed here: script/fmt and script/fmt-check run
+# it with `go run` at a pinned commit.
 # The linter is NOT installed here: golangci-lint runs via docker only
 # (script/lint), pinned by image digest, so its only prerequisite is a
-# working docker. Nor is prettier: script/fmt and
-# script/fmt-check-markdown run it in a container from Dockerfile.fmt.
+# working docker. Nor is prettier: script/fmt and script/fmt-check run
+# it in a stage of the Dockerfile.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -67,12 +67,12 @@ main() {
     if missing make; then pkg_install gnumake make make make; fi
     if missing go; then pkg_install go golang go go; fi
 
-    # Linting and the markdown formatter run via docker only. Warn,
-    # don't fail: building and testing work without it.
+    # Testing, linting and the markdown formatter run via docker only.
+    # Warn, don't fail: make build works without it.
     if missing docker; then
         echo "bootstrap: WARNING: docker not found; install it to" \
-            "run make lint, make fmt, make fmt-check, make check" \
-            "and make docker." >&2
+            "run make test, make lint, make fmt, make fmt-check," \
+            "make check and make docker." >&2
     fi
 
     go mod download