build: re-vendor canonical files from prompts dd4027b (closes #257)

The canonical files are fetched whole from sneak/prompts at dd4027b.
Kept after the canonical content: the livednstest deny entry in
.golangci.yml, /bin in .dockerignore, and this repo's own .gitignore
lines. The workflow keeps its concurrency block and
persist-credentials: false. Lint and test are phases of the Dockerfile
(golangci-lint v2.14.0; tests on the Debian Go 1.25.7 image with the
same flags); the build stage depends on both and stamps the version the
canonical way. Dockerfile.lint is gone; the prettier stages of
Dockerfile.fmt moved into the Dockerfile, so Markdown formatting still
runs in Docker. Every scripted docker build passes --no-cache;
script/cibuild bootstraps, runs script/check, then builds the image.
script/fmt-check absorbs fmt-check-go and fmt-check-markdown.

Model: opus-5-5

.editorconfig

@@ -10,6 +10,3 @@ insert_final_newline = true
 
 [Makefile]
 indent_style = tab
-
-[*.go]
-indent_style = tab

.gitignore

@@ -47,9 +47,6 @@ node_modules/
 [iI][dD]_[eE][dD]25519_[sS][kK]
 
 # This repository's own entries, kept after the canonical content above.
-*.log
-*.out
-*.test
 bin/
 vendor/
 data/

Dockerfile

@@ -18,10 +18,6 @@ RUN golangci-lint run --config .golangci.yml ./...
 # it ends, because the first run already failed.
 # golang 1.25.7-trixie, 2026-10-06
 FROM golang@sha256:2b174ffcf56c7ad0c47d30d2630693265639ddf2a5141149c2da34db921791b4 AS test
-# The file permission tests skip themselves as root, so the tests run as
-# an ordinary user, whose home directory holds Go's build cache.
-RUN useradd --create-home tester
-USER tester
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download