build: re-vendor canonical files from prompts dd4027b (closes #257)

The canonical files are fetched whole from sneak/prompts at dd4027b;
.golangci.yml keeps the livednstest deny entry and .dockerignore adds
/bin. Lint and test are phases of the Dockerfile (golangci-lint
v2.14.0; tests on the Debian Go 1.25.7 image with the same flags), and
the build stage depends on both and stamps the version the canonical
way. Dockerfile.lint is gone; the prettier stages of Dockerfile.fmt
moved into the Dockerfile, so Markdown formatting still runs in Docker.
Every scripted docker build passes --no-cache; script/cibuild
bootstraps, runs script/check, then builds the image. script/fmt-check
absorbs fmt-check-go and fmt-check-markdown. The canonical .gitignore
has no bin/ entry. The new linter raised no findings.

Model: opus-5-5

script/cibuild

@@ -1,14 +1,10 @@
 #!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile's lint stage runs
-# the Go half of make fmt-check and golangci-lint; its builder stage
-# runs make test and make build. The markdown half of make fmt-check
-# runs after that build, as its own build of Dockerfile.fmt, because
-# there is no docker inside a docker build.
-#
-# --no-cache-filter=lint,builder runs both stages on every invocation;
-# otherwise an unchanged tree is served from the layer cache and passes
-# without linting or querying live DNS. script/fmt-check-markdown busts
-# its own cache the same way.
+# script/cibuild: run the CI build. It bootstraps first: a CI runner
+# checks out and runs this and nothing else, and script/fmt-check runs
+# the formatter on the host, which a pristine checkout cannot do.
+# --no-cache for the same reason as script/docker: the gate phases the
+# final stage depends on are RUN steps, and a cached one is a check that
+# did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -16,8 +12,17 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build --no-cache-filter=lint,builder .
-    "$SCRIPT_DIR/fmt-check-markdown"
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/check"
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"