build: re-vendor canonical files from prompts dd4027b (closes #257)

The canonical files are fetched whole from sneak/prompts at dd4027b.
Kept after the canonical content: the livednstest deny entry in
.golangci.yml, /bin in .dockerignore, and this repo's own .gitignore
lines. The workflow keeps its concurrency block and
persist-credentials: false. Lint and test are phases of the Dockerfile
(golangci-lint v2.14.0; tests on the Debian Go 1.25.7 image with the
same flags); the build stage depends on both and stamps the version the
canonical way. Dockerfile.lint is gone; the prettier stages of
Dockerfile.fmt moved into the Dockerfile, so Markdown formatting still
runs in Docker. Every scripted docker build passes --no-cache;
script/cibuild bootstraps, runs script/check, then builds the image.
script/fmt-check absorbs fmt-check-go and fmt-check-markdown.

Model: opus-5-5

TODO.md

@@ -19,6 +19,9 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Completed Steps
 
+- 2026-10-06: canonical files re-fetched from `sneak/prompts` at `dd4027b`; lint
+  and test are phases of the `Dockerfile`, every scripted build uncached (closes
+  #257).
 - 2026-10-05: a name listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no
   Record Change or Inconsistency notification; a name listed there that is not
   in `DNSWATCHER_TARGETS` stops startup (closes #255).