Re-vendor the canonical files from sneak/prompts dd4027b (closes #159, closes #116)

Fetches .dockerignore, .editorconfig, the CI workflow, .gitignore,
.golangci.yml, .prettierignore, .prettierrc and REPO_POLICIES.md byte
for byte from sneak/prompts dd4027b; this repo's own entries follow the
canonical text in .dockerignore, .gitignore and .editorconfig. The new
.golangci.yml disables gomodguard. The Dockerfile gets a lint phase on
golangci-lint v2.14.0 and a test phase on the Debian Go image; the
build stage depends on both and stamps the version as the policy shows.
script/test and script/lint build only their phase, and script/cibuild
bootstraps and runs script/check first. bin/tools goes: script/bootstrap
installs gofumpt and protoc-gen-go into bin/ with go install pinned to a
commit.

Model: opus-5-5

script/gofumpt

@@ -3,17 +3,16 @@
 #
 # Takes exactly one mode argument, --write or --check, and runs the same
 # gofumpt version over the same files in both modes. script/fmt and
-# script/fmt-check both go through here, and so does the Docker lint
-# stage, so what gets formatted and what gets verified cannot drift
-# apart.
+# script/fmt-check both go through here, so what gets formatted and what
+# gets verified cannot drift apart.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# The gofumpt version is the one bin/tools/go.mod pins. `go tool` run in
-# bin/tools builds it from source checked against the hashes in
-# bin/tools/go.sum, so neither a developer machine nor the lint image needs
-# it installed.
+# The gofumpt script/bootstrap installs into bin/. Must match the pin
+# there.
+GOFUMPT_VERSION="v0.12.0"
+GOFUMPT="$ROOT/bin/gofumpt"
 
 usage() {
     echo "usage: script/gofumpt --write|--check" >&2
@@ -22,15 +21,22 @@ usage() {
 
 main() {
     [ "$#" -eq 1 ] || usage
-    cd "$ROOT/bin/tools"
+    # A bin/gofumpt left from before the pin moved formats differently, so
+    # it fails here until script/bootstrap replaces it.
+    actual="$("$GOFUMPT" --version 2>/dev/null | cut -d' ' -f1)"
+    if [ "$actual" != "$GOFUMPT_VERSION" ]; then
+        echo "gofumpt: needs $GOFUMPT_VERSION in bin/gofumpt," \
+            "found: ${actual:-none}; run script/bootstrap" >&2
+        exit 1
+    fi
     # Every Go file in the repo, from $ROOT down. gofumpt holds generated
     # files, such as mfer/mf.pb.go, to gofmt's rules only.
     case "$1" in
-        --write) go tool gofumpt -l -w "$ROOT" ;;
+        --write) "$GOFUMPT" -l -w "$ROOT" ;;
         --check)
             # Own line: a failing command inside `[ -n "$(...)" ]` does
             # not trip `set -e`, so a gofumpt that never ran would pass.
-            unformatted="$(go tool gofumpt -l "$ROOT")"
+            unformatted="$("$GOFUMPT" -l "$ROOT")"
             if [ -n "$unformatted" ]; then
                 echo "gofumpt: files need formatting (run make fmt):" >&2
                 echo "$unformatted" >&2