Re-vendor the canonical files from sneak/prompts dd4027b (closes #159, closes #116)

Fetches .dockerignore, .editorconfig, the CI workflow, .gitignore,
.golangci.yml, .prettierignore, .prettierrc and REPO_POLICIES.md byte
for byte from sneak/prompts dd4027b; this repo's own entries follow the
canonical text in .dockerignore, .gitignore and .editorconfig. The new
.golangci.yml disables gomodguard. The Dockerfile gets a lint phase on
golangci-lint v2.14.0 and a test phase on the Debian Go image; the
build stage depends on both and stamps the version as the policy shows.
script/test and script/lint build only their phase, and script/cibuild
bootstraps and runs script/check first. bin/tools goes: script/bootstrap
installs gofumpt and protoc-gen-go into bin/ with go install pinned to a
commit.

Model: opus-5-5

README.md

@@ -55,9 +55,9 @@ for a single command's options.
 
 # Build Status
 
-CI runs `script/cibuild`, which builds the Docker image with `--no-cache`, so
-the formatting, lint and test steps in the `Dockerfile` run on every build. The
-`main` branch must always be green.
+CI runs `script/cibuild`, which runs `script/bootstrap` and `script/check`, then
+builds the Docker image with `--no-cache`, so the lint and test phases in the
+`Dockerfile` run on every build. The `main` branch must always be green.
 
 # Entrypoints
 
@@ -68,18 +68,22 @@ development workflow, and the Makefile targets are thin shims that call them. We
 provide:
 
 - `script/bootstrap` — install all dependencies, idempotently: Go and the
-  modules of both `go.mod` and `bin/tools/go.mod`; node (the version `.nvmrc`
-  names, through nvm when there is no node on `PATH`) and yarn, plus the
-  prettier version pinned in `package.json`/`yarn.lock`; and `protoc` 33.4,
-  unpacked into `bin/protoc` from its release archive once the archive matches
-  the sha256 the script holds for this platform. golangci-lint is not installed,
-  it runs only in Docker
+  modules of `go.mod`; node (the version `.nvmrc` names, through nvm when there
+  is no node on `PATH`) and yarn, plus the prettier version pinned in
+  `package.json`/`yarn.lock`; `gofumpt` v0.12.0 and `protoc-gen-go` v1.36.11,
+  installed into `bin/` with `go install`, each pinned to a commit; and `protoc`
+  33.4, unpacked into `bin/protoc` from its release archive once the archive
+  matches the sha256 the script holds for this platform. Each of those three is
+  installed again whenever the one in `bin/` reports another version.
+  golangci-lint is not installed, it runs only in Docker
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (`mfer`); used by other scripts
   such as `script/docker`
-- `script/test` — run the test suite (`go test`); one test fails when
-  `mfer/mf.proto` no longer matches the hash `script/generate` recorded
+- `script/test` — run the test suite in Docker: builds only the `test` stage of
+  the `Dockerfile`, whose build runs `go test -race`, uncached so it runs every
+  time; one test fails when `mfer/mf.proto` no longer matches the hash
+  `script/generate` recorded
 - `script/build` (`make build`) — build the `mfer` binary into `bin/mfer`,
   stamped with the revision `mfer version` prints: the output of
   `git describe --tags --always --dirty`, as `script/docker` passes it
@@ -87,23 +91,20 @@ provide:
   `mfer/mf.proto` and record the hash of that `mfer/mf.proto` in
   `mfer/mf.proto.sha256`; the only thing that regenerates the committed
   `mfer/mf.pb.go`. It runs the `protoc` that `script/bootstrap` unpacks into
-  `bin/protoc`, refusing any version but 33.4, and the `protoc-gen-go` that
-  `bin/tools/go.mod` pins, which `go tool` builds from source checked against
-  the hashes in `bin/tools/go.sum`
+  `bin/protoc` and the `protoc-gen-go` it installs into `bin/`, refusing any
+  version of either but the pinned one
 - `script/fuzz` — fuzz the manifest parser for one minute; run by hand
   (`make fuzz`), never by CI, while `script/test` runs its committed seed corpus
   as ordinary tests
 - `script/lint` — run `golangci-lint` in Docker: builds only the `lint` stage of
-  the `Dockerfile` (the Go format check, then the linter), uncached so it runs
-  every time, then removes the image
+  the `Dockerfile`, whose build runs the linter, uncached so it runs every time
 - `script/fmt` — format all code and docs (writes): `script/gofumpt --write` and
   `script/prettier --write`
 - `script/gofumpt` — run `gofumpt` over every Go file in the repository in the
-  given mode, `--write` or `--check`, at the version `bin/tools/go.mod` pins
-  (built on demand by `go tool` from source checked against the hashes in
-  `bin/tools/go.sum`, so nothing installs it); `script/fmt`, `script/fmt-check`
-  and the Docker lint stage all go through it, so they cannot disagree about Go
-  formatting
+  given mode, `--write` or `--check`, with the `bin/gofumpt` that
+  `script/bootstrap` installs, refusing any version but the pinned one;
+  `script/fmt` and `script/fmt-check` both go through it, so they cannot
+  disagree about Go formatting
 - `script/prettier` — run prettier over the repository's canonical file set
   (Markdown and JSON, minus `.prettierignore`) in the given mode, `--write` or
   `--check`, with the prettier version `yarn.lock` pins, run by the node on
@@ -114,8 +115,9 @@ provide:
   `script/gofumpt --check` plus `script/prettier --check`
 - `script/check` — run `script/test`, `script/lint`, and `script/fmt-check`
 - `script/docker` — build the Docker image tagged with the project name
-- `script/cibuild` — CI entrypoint: builds the image with the same command as
-  `script/docker`, uncached, so the checks in the Dockerfile run every time
+- `script/cibuild` — CI entrypoint: runs `script/bootstrap` and `script/check`,
+  then builds the image with the same command as `script/docker`, uncached, so
+  the lint and test phases in the `Dockerfile` run every time
 - `script/precommit` — pre-commit checks: `go mod tidy` verification, then
   `script/check`
 - `script/install-precommit` — install the git pre-commit hook that runs