build: re-vendor canonical files from prompts dd4027b (closes #257)

The canonical files are fetched whole from sneak/prompts at dd4027b.
Kept after the canonical content: the livednstest deny entry in
.golangci.yml, /bin in .dockerignore, this repo's own .gitignore lines
and a [*.go] tab section in .editorconfig. The workflow keeps its
concurrency block and persist-credentials: false. Lint and test are
phases of the Dockerfile (golangci-lint v2.14.0; tests on the Debian
Go 1.25.7 image as an ordinary user, with the same flags); the build
stage depends on both and stamps the version the canonical way.
Dockerfile.lint is gone; the prettier stages of Dockerfile.fmt moved
into the Dockerfile. Every scripted docker build passes --no-cache;
script/cibuild bootstraps, runs script/check, then builds the image.
script/fmt-check absorbs fmt-check-go and fmt-check-markdown.

Model: opus-5-5

.editorconfig

@@ -10,3 +10,6 @@ insert_final_newline = true
 
 [Makefile]
 indent_style = tab
+
+[*.go]
+indent_style = tab

.gitignore

@@ -47,6 +47,9 @@ node_modules/
 [iI][dD]_[eE][dD]25519_[sS][kK]
 
 # This repository's own entries, kept after the canonical content above.
+*.log
+*.out
+*.test
 bin/
 vendor/
 data/

Dockerfile

@@ -18,6 +18,10 @@ RUN golangci-lint run --config .golangci.yml ./...
 # it ends, because the first run already failed.
 # golang 1.25.7-trixie, 2026-10-06
 FROM golang@sha256:2b174ffcf56c7ad0c47d30d2630693265639ddf2a5141149c2da34db921791b4 AS test
+# The file permission tests skip themselves as root, so the tests run as
+# an ordinary user, whose home directory holds Go's build cache.
+RUN useradd --create-home tester
+USER tester
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download