Re-vendor the canonical files from sneak/prompts dd4027b (closes #159, closes #116)

Fetches .dockerignore, .editorconfig, the CI workflow, .gitignore,
.golangci.yml, .prettierignore, .prettierrc and REPO_POLICIES.md byte
for byte from sneak/prompts dd4027b, keeping this repo's anchored
host-built artifacts in .dockerignore; the new .golangci.yml disables
gomodguard. The Dockerfile gets a lint phase on golangci-lint v2.14.0
and a test phase on the Debian Go image; the build stage depends on
both and stamps the version as the policy shows. script/test and
script/lint build only their phase, and script/cibuild bootstraps and
runs script/check first. bin/tools goes: script/bootstrap installs
gofumpt and protoc-gen-go into bin/ with go install pinned to a commit,
and bin/.gitignore ignores what lands in bin/.

Model: opus-5-5

script/check

@@ -1,7 +1,8 @@
 #!/bin/sh
 # script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
-# Generic: usually needs no adaptation.
+# extension to scripts-to-rule-them-all. test and lint are Docker
+# phases; fmt-check is native, because a formatter writes the working
+# tree. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"