fmt: format and check Markdown with prettier in a container (closes #119)

make fmt and make fmt-check now cover every Markdown file with prettier
(4-space tabs, proseWrap always), as template-app-go does: prettier is
pinned by package.json and yarn.lock and runs in a docker build on a
digest-pinned node image, never on the host. The check is forced to run
with --no-cache-filter, as script/lint is.

script/fmt-check is split into a Go half and a Markdown half because the
Dockerfile lint stage cannot run docker: that stage now runs the Go half
and script/cibuild runs the Markdown half after the build. *.md leaves
.dockerignore so documents reach the build context.

README.md, TESTING.md and TODO.md are reformatted by make fmt; apart from
the README Entrypoints entries, its make fmt line under Building and the
TODO entry, that diff is mechanical.

Model: opus-5-5

TESTING.md

@@ -2,44 +2,43 @@
 
 ## DNS Resolution Tests
 
-DNS is never mocked in this project, not in tests and not anywhere
-else; see the README section "No DNS mocking. Ever." Every test that
-looks something up in DNS **MUST** query live DNS servers, never a
-stand-in. Logic that works on record data, such as comparing or
-formatting records, may be tested on that data directly with no
-lookup.
+DNS is never mocked in this project, not in tests and not anywhere else; see the
+README section "No DNS mocking. Ever." Every test that looks something up in DNS
+**MUST** query live DNS servers, never a stand-in. Logic that works on record
+data, such as comparing or formatting records, may be tested on that data
+directly with no lookup.
 
 ### Rationale
 
-The resolver performs iterative resolution from root nameservers through
-the full delegation chain. Mocked responses cannot faithfully represent
-the variety of real-world DNS behavior (truncation, referrals, glue
-records, DNSSEC, varied response times, EDNS, etc.). Testing against
-real servers ensures the resolver works correctly in production.
+The resolver performs iterative resolution from root nameservers through the
+full delegation chain. Mocked responses cannot faithfully represent the variety
+of real-world DNS behavior (truncation, referrals, glue records, DNSSEC, varied
+response times, EDNS, etc.). Testing against real servers ensures the resolver
+works correctly in production.
 
 ### Constraints
 
 - Tests hit real DNS infrastructure and require network access
-- Test duration depends on network conditions; timeout tuning keeps
-  the suite within the 60-second target
-- Query timeout is calibrated to 3× maximum antipodal RTT (~300ms)
-  plus processing margin
+- Test duration depends on network conditions; timeout tuning keeps the suite
+  within the 60-second target
+- Query timeout is calibrated to 3× maximum antipodal RTT (~300ms) plus
+  processing margin
 - Root server fan-out is limited to reduce parallel query load
-- Live lookups that expect an answer go through `internal/livednstest`,
-  which limits how many run at once in a test binary and retries a
-  lookup that got none
-- Flaky failures from transient network issues are acceptable and
-  should be investigated as potential resolver bugs, not papered over
-  with mocks or skip flags
+- Live lookups that expect an answer go through `internal/livednstest`, which
+  limits how many run at once in a test binary and retries a lookup that got
+  none
+- Flaky failures from transient network issues are acceptable and should be
+  investigated as potential resolver bugs, not papered over with mocks or skip
+  flags
 
 ### What NOT to do
 
-- **Do not mock, fake or stub DNS** anywhere: no stand-in `DNSClient`,
-  no stand-in for the watcher's `DNSResolver`, no fake DNS server, no
-  canned responses
+- **Do not mock, fake or stub DNS** anywhere: no stand-in `DNSClient`, no
+  stand-in for the watcher's `DNSResolver`, no fake DNS server, no canned
+  responses
 - **Do not add `-short` flags** to skip slow tests
 - **Do not increase `-timeout`** to hide hanging queries
-- **Do not remove `-count=1` from `script/test`** — Go's test cache
-  replays a previous run's output without querying anything, so a
-  cached pass is not evidence that live resolution works
+- **Do not remove `-count=1` from `script/test`** — Go's test cache replays a
+  previous run's output without querying anything, so a cached pass is not
+  evidence that live resolution works
 - **Do not modify linter configuration** to suppress findings