Add canonical policy dotfiles, harden both ignore files (closes #8)

REPO_POLICIES.md lists the files every repo must contain at minimum;
four were missing here and .gitignore covered only Hugo's outputs.

REPO_POLICIES.md is a byte-identical copy of the canonical file in the
prompts repo, YAML front matter (title, last_modified) intact so it can
be diffed against upstream as policy evolves. It is not clean under this
repo's prettier settings, so the reformat is the next commit rather than
churn mixed in here; the byte-identical copy is what landed.

.editorconfig, .prettierrc and .prettierignore are the canonical
contents. script/fmt and script/fmt-check keep passing --tab-width 4
--prose-wrap always on the command line: the duplication is deliberate
so the scripts still work standalone when copied as a template, and the
values agree, so adding .prettierrc changes nothing about what make fmt
does.

.gitignore keeps its three Hugo lines and gains the canonical
OS/editor/node/secrets block plus .claude/. The secrets patterns are the
point: a stray .env or private key can no longer be committed by a broad
git add. .claude/ holds worktrees/, so without it a clean checkout with
agent tooling present is not git status-clean.

.dockerignore gains the same coverage but not the same syntax. It does
not use .gitignore semantics: it matches with Go's filepath.Match rules
extended with **, where * does not cross / and an unprefixed pattern is
anchored at the context root. A bare *.key therefore excludes
./server.key and ships ./certs/server.key into the image, which is worse
than an obviously incomplete file because it reads as complete. Every
depth-independent pattern here carries an explicit **/ prefix; only the
entries that are genuinely root-anchored by definition go bare - .git,
Hugo's public and resources output directories, and .hugo_build.lock.
The distinction is spelled out in a comment at the top of the file so
the next edit does not quietly undo it.

Excluding .claude/ also keeps entire additional checkouts of this repo
out of the build context, which the Dockerfile's COPY . . would
otherwise copy into the image.

Verified by planting .env, server.key, deep.pem and node_modules two
directories deep and building: with the patterns unprefixed all of them
reach /src in the image, with **/ none do. Root-only testing does not
exercise this and produces a false pass.

TODO.md

@@ -13,20 +13,41 @@
 pre-1.0
 
 No git tags. The site is live and now has the scripts-to-rule-them-all scaffold
-(`Makefile`, `script/`, `Dockerfile`, `check.yml`); still missing `LICENSE` and
-policy files. Every external reference in the repo is now pinned by
-cryptographic hash (or, for the wrangler CLI install, an exact version), and the
-Hugo that builds the published site is a deliberate pinned version rather than
-whatever the base image's package repo serves.
+(`Makefile`, `script/`, `Dockerfile`, `check.yml`) and the canonical policy
+dotfiles; `LICENSE` is the only mandated file still missing. Every external
+reference in the repo is now pinned by cryptographic hash (or, for the wrangler
+CLI install, an exact version), and the Hugo that builds the published site is a
+deliberate pinned version rather than whatever the base image's package repo
+serves.
 
 # Next Step
 
-Add the remaining policy scaffold: `LICENSE`, `REPO_POLICIES.md`,
-`.editorconfig`, and prettier config files (`.prettierrc`, `.prettierignore`).
-Update `README.md` accordingly.
+Add `LICENSE` (#10) and replace the README's "content is provided as-is" note
+with the committed license. Blocked on the owner's choice of license — the
+remaining policy scaffold is otherwise complete.
 
 # Completed Steps
 
+- 2026-08-09: added the canonical policy dotfiles and hardened both ignore files
+  (closes #8). `REPO_POLICIES.md` is a byte-identical copy of the canonical
+  `prompts` file, front matter intact; `.editorconfig`, `.prettierrc` and
+  `.prettierignore` are the canonical contents. `.gitignore` keeps its three
+  Hugo lines and gains the OS/editor/node/secrets block plus `.claude/`, so a
+  clean checkout with agent tooling present is `git status`-clean and a stray
+  key or `.env` can no longer be committed. `.dockerignore` gained the same
+  coverage but **not** the same syntax: it matches with Go's `filepath.Match`
+  rules extended with `**`, where `*` does not cross `/` and an unprefixed
+  pattern is anchored at the context root, so every depth-independent pattern
+  carries an explicit `**/` prefix and only the genuinely root-anchored entries
+  (`.git`, `public`, `resources`, `.hugo_build.lock`) go bare. Verified by
+  planting `.env`, `*.key`, `*.pem` and `node_modules` two directories deep: the
+  unprefixed form shipped all of them into the image and the `**/` form ships
+  none. Excluding `.claude/` also takes `worktrees/` — entire additional
+  checkouts of this repo — out of the build context; #23's two-consecutive-run
+  proof was re-run against the smaller context, since that issue was validated
+  against the old one. Note the canonical upstream `REPO_POLICIES.md` is not
+  clean under this repo's prettier settings, so the reformat is a separate
+  follow-up commit rather than churn mixed into this one
 - 2026-08-09: stopped `script/cibuild` reporting a green it never earned (closes
   #23). `COPY . .` is keyed on content, so on an unchanged tree Docker served
   `RUN make check` from cache: the checks never executed and the build still
@@ -124,8 +145,8 @@ Update `README.md` accordingly.
 - Rework README.md into the standard sections: Description, Getting Started,
   Rationale, Design, TODO, License, Author (currently About, Contributing,
   Technical Details, License)
-- Replace the "content is provided as-is" README note with the text of the
-  committed LICENSE
-- Expand .gitignore beyond Hugo outputs (OS and editor files)
+- Sync the reformat of `REPO_POLICIES.md` back upstream to `prompts` so the
+  canonical copy is clean under the shared prettier settings and future syncs
+  are a straight byte copy
 - Verify the Cloudflare Pages deploy still works after the workflow changes
 - Keep mesh channel and signal group listings current