Current templates: safe.directory, golangci-lint v2.14.0, fetch-depth 0, the policy's last stage (closes #50)

Brings keyfunc to the current sneak/prompts templates: REPO_POLICIES.md and .golangci.yml are the template copies, the lint phase runs golangci-lint v2.14.0 on the template digest (its one new finding fixed), and .dockerignore gains the template line for submodule configs. The stage that compiles keyfunc marks /src safe for git, so a context sent as a tar stream still stamps the tag or short commit. The last stage is now a development environment, as the policy asks of a non-server repo: run the tool as docker run IMAGE keyfunc .... The CI checkout fetches tags.

Deviation: .gitea/workflows/check.yml differs from the template copy by fetch-depth: 0, which REPO_POLICIES.md requires.

Model: opus-5-5

README.md

@@ -331,7 +331,10 @@ standard: most Makefile targets are thin shims over an executable in `script/`
 - `script/docker` builds the Docker image, uncached, tagged with the project
   name and stamped with the version `git describe` gives on the host. The image
   cannot be built unless the `lint` and `test` phases pass, so a plain
-  `docker build .` runs them too.
+  `docker build .` runs them too. The image is a development environment, not a
+  runtime image: the Debian Go image with what `script/bootstrap` installs, the
+  source tree in `/src`, and `keyfunc` built from it on the `PATH`.
+  `docker run --rm -it keyfunc` opens a shell in it.
 - `script/cibuild` is the CI build the Gitea workflow calls: it runs
   `bootstrap`, then `check`, then builds the image as `script/docker` does.
 - `script/precommit` is what the git pre-commit hook runs: `go mod tidy` and