Current templates: safe.directory, golangci-lint v2.14.0, fetch-depth 0, the policy's last stage (closes #50)

Brings keyfunc to the current sneak/prompts templates: REPO_POLICIES.md and .golangci.yml are the template copies, the lint phase runs golangci-lint v2.14.0 on the template digest (its one new finding fixed), and .dockerignore gains the template line for submodule configs. The stage that compiles keyfunc marks /src safe for git, so a context sent as a tar stream still stamps the tag or short commit. The last stage is now a development environment, as the policy asks of a non-server repo: run the tool as docker run IMAGE keyfunc .... The CI checkout fetches tags.

Deviation: .gitea/workflows/check.yml differs from the template copy by fetch-depth: 0, which REPO_POLICIES.md requires.

Model: opus-5-5

internal/cli/cli.go

@@ -86,8 +86,7 @@ func Main() int {
 		return 0
 	}
 
-	var passed ssh.StatusError
-	if errors.As(err, &passed) {
+	if passed, ok := errors.AsType[ssh.StatusError](err); ok {
 		return passed.Status
 	}
 

internal/cli/ssh/to.go

@@ -88,8 +88,7 @@ func connect(ctx context.Context, argv []string) error {
 		return nil
 	}
 
-	var ended *exec.ExitError
-	if errors.As(err, &ended) {
+	if ended, ok := errors.AsType[*exec.ExitError](err); ok {
 		status := ended.ExitCode()
 		if status < 0 {
 			// A signal ended ssh, and a signal has no status of its