fmt: format and check Markdown with prettier in a container (closes #119)

make fmt and make fmt-check now cover every Markdown file with prettier
(4-space tabs, proseWrap always), as template-app-go does: prettier is
pinned by package.json and yarn.lock and runs in a docker build on a
digest-pinned node image, never on the host. The check is forced to run
with --no-cache-filter, as script/lint is.

script/fmt-check is split into a Go half and a Markdown half because the
Dockerfile lint stage cannot run docker: that stage now runs the Go half
and script/cibuild runs the Markdown half after the build. *.md leaves
.dockerignore so documents reach the build context.

README.md, TESTING.md and TODO.md are reformatted by make fmt; apart from
the README Entrypoints entries, its make fmt line under Building and the
TODO entry, that diff is mechanical.

Model: opus-5-5

.dockerignore

@@ -1,6 +1,9 @@
 .git/
 bin/
-*.md
+node_modules/
+# No .md may be excluded: Dockerfile.fmt checks every document with
+# prettier, and an exclusion here would drop a file from that check while
+# prettier still reports every file it was handed clean.
 LICENSE
 .editorconfig
 .gitignore