Configure prettier and make fmt-check cover markdown (closes #69)

script/fmt ran prettier with default settings over root-level *.md and
*.json, swallowing every failure with `|| true`, while script/fmt-check
checked gofmt only. The formatter and the gate therefore disagreed
silently: `make fmt` rewrote markdown that `make check` never looked at,
including REPO_POLICIES.md, which is a verbatim copy of an authoritative
upstream document that local tooling must not touch.

Configuration:

- .prettierrc pins the two policy deviations from prettier defaults,
  four-space indents and proseWrap: always. Nothing else.
- .prettierignore excludes REPO_POLICIES.md so no local run can drift it
  from upstream again, plus .golangci.yml (user-owned, and listed even
  though the current file set does not reach it) and node_modules,
  vendor, bin.

One canonical file set:

- New script/prettier takes --write or --check and applies the same
  patterns in both modes, so script/fmt and script/fmt-check cannot
  drift apart by construction. The patterns are repo-wide (**/*.md,
  **/*.json) rather than root-only, so markdown in subdirectories such
  as a future docs/ is covered.
- No `|| true` anywhere, and no --no-error-on-unmatched-pattern: both
  patterns always match tracked files, so an empty match means the glob
  broke and prettier should say so instead of passing vacuously. A
  missing prettier is a hard error naming script/bootstrap, not a
  silent skip.

Pinned prettier:

- package.json/yarn.lock pin prettier 3.9.6; the lockfile carries the
  integrity hash, and --frozen-lockfile enforces it. script/prettier
  prefers node_modules/.bin/prettier and warns on stderr when it has to
  fall back to a PATH prettier of unknown version.
- script/bootstrap now installs node, yarn, and the locked JS deps. Its
  NODE_VERSION and YARN_VERSION pins already existed.

Docker gate:

- The golangci-lint image has no node, so the lint stage runs the new
  script/fmt-check-go (the Go half of fmt-check, extracted) instead of
  the whole thing.
- The markdown half gets its own stage on a digest-pinned node image
  shipping exactly the node and yarn versions bootstrap pins. The
  builder stage takes a COPY --from dependency on it, so BuildKit cannot
  skip it and a markdown violation fails `docker build .` rather than
  being skipped somewhere nobody looks.

Markdown files other than REPO_POLICIES.md are reformatted here for the
first time under the policy settings.

FORMAT.md

@@ -5,9 +5,9 @@ Version 1.0
 ## Overview
 
 An `.mf` file is a binary manifest that describes a directory tree of files,
-including their paths, sizes, and cryptographic checksums. It supports
-optional GPG signatures for integrity verification and optional timestamps
-for metadata preservation.
+including their paths, sizes, and cryptographic checksums. It supports optional
+GPG signatures for integrity verification and optional timestamps for metadata
+preservation.
 
 ## File Structure
 
@@ -39,15 +39,15 @@ The outer message contains:
 
 ### SHA-256 Hash
 
-The `sha256` field (104) covers the **compressed** `innerMessage` bytes.
-This allows verifying data integrity before decompression.
+The `sha256` field (104) covers the **compressed** `innerMessage` bytes. This
+allows verifying data integrity before decompression.
 
 ## Compression
 
-The `innerMessage` field is compressed with [Zstandard (zstd)](https://facebook.github.io/zstd/).
-Implementations must enforce a decompression size limit to prevent
-decompression bombs. The reference implementation limits decompressed size to
-256 MB.
+The `innerMessage` field is compressed with
+[Zstandard (zstd)](https://facebook.github.io/zstd/). Implementations must
+enforce a decompression size limit to prevent decompression bombs. The reference
+implementation limits decompressed size to 256 MB.
 
 ## Inner Message (`MFFile`)
 
@@ -114,11 +114,11 @@ Where:
 
 - `ZNAVSRFG` is the magic bytes string (literal ASCII)
 - `<UUID>` is the hex-encoded UUID from the outer message
-- `<SHA256>` is the hex-encoded SHA-256 hash from the outer message (covering compressed data)
+- `<SHA256>` is the hex-encoded SHA-256 hash from the outer message (covering
+  compressed data)
 
-Components are separated by hyphens. The signature is produced by GPG over
-this canonical string and stored in the `signature` field of the outer
-message.
+Components are separated by hyphens. The signature is produced by GPG over this
+canonical string and stored in the `signature` field of the outer message.
 
 ## Deterministic Serialization
 
@@ -134,10 +134,11 @@ changed).
 
 ## MIME Type
 
-The recommended MIME type for `.mf` files is `application/octet-stream`.
-The `.mf` file extension is the canonical identifier.
+The recommended MIME type for `.mf` files is `application/octet-stream`. The
+`.mf` file extension is the canonical identifier.
 
 ## Reference
 
 - Proto definition: [`mfer/mf.proto`](mfer/mf.proto)
-- Reference implementation: [git.eeqj.de/sneak/mfer](https://git.eeqj.de/sneak/mfer)
+- Reference implementation:
+  [git.eeqj.de/sneak/mfer](https://git.eeqj.de/sneak/mfer)