Re-vendor the canonical files from sneak/prompts dd4027b (closes #159, closes #116)

Fetches .dockerignore, .editorconfig, the CI workflow, .gitignore,
.golangci.yml, .prettierignore, .prettierrc and REPO_POLICIES.md byte
for byte from sneak/prompts dd4027b, keeping this repo's anchored
host-built artifacts in .dockerignore; the new .golangci.yml disables
gomodguard. The Dockerfile gets a lint phase on golangci-lint v2.14.0
and a test phase on the Debian Go image; the build stage depends on
both and stamps the version as the policy shows. script/test and
script/lint build only their phase, and script/cibuild bootstraps and
runs script/check first. bin/tools goes: script/bootstrap installs
gofumpt and protoc-gen-go into bin/ with go install pinned to a commit,
and bin/.gitignore ignores what lands in bin/.

Model: opus-5-5

script/generate

@@ -5,16 +5,18 @@
 # protoc. A test fails while mf.proto no longer matches the recorded hash.
 #
 # Runs the protoc that script/bootstrap unpacks into bin/protoc, and the
-# protoc-gen-go that bin/tools/go.mod pins. Another version of either
-# writes a different mf.pb.go.
+# protoc-gen-go it installs into bin/. Another version of either writes a
+# different mf.pb.go.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# The protoc version script/bootstrap installs. protoc 33.4 names itself
-# v6.33.4 in the mf.pb.go header.
+# The versions script/bootstrap installs. protoc 33.4 names itself v6.33.4
+# in the mf.pb.go header.
 PROTOC_VERSION="33.4"
 PROTOC="$ROOT/bin/protoc/bin/protoc"
+PROTOC_GEN_GO_VERSION="v1.36.11"
+PROTOC_GEN_GO="$ROOT/bin/protoc-gen-go"
 
 # sha256 <file>: print "<hash>  <file>", with sha256sum, or with shasum
 # where there is no sha256sum.
@@ -30,23 +32,26 @@ sha256() {
 }
 
 main() {
-    # A bin/protoc left from before the pin moved fails here, until
-    # script/bootstrap replaces it.
+    # A bin/protoc or bin/protoc-gen-go left from before its pin moved
+    # fails here, until script/bootstrap replaces it.
     actual="$("$PROTOC" --version 2>/dev/null || true)"
     if [ "$actual" != "libprotoc $PROTOC_VERSION" ]; then
         echo "generate: needs protoc $PROTOC_VERSION in bin/protoc," \
             "found: ${actual:-none}; run script/bootstrap" >&2
         exit 1
     fi
-    # `go tool -n` builds protoc-gen-go from bin/tools and prints where the
-    # binary is, without running it.
-    plugin="$(cd "$ROOT/bin/tools" && go tool -n protoc-gen-go)"
+    actual="$("$PROTOC_GEN_GO" --version 2>/dev/null || true)"
+    if [ "$actual" != "protoc-gen-go $PROTOC_GEN_GO_VERSION" ]; then
+        echo "generate: needs protoc-gen-go $PROTOC_GEN_GO_VERSION in" \
+            "bin/protoc-gen-go, found: ${actual:-none}; run script/bootstrap" >&2
+        exit 1
+    fi
 
     cd "$ROOT/mfer"
     # Hashed before regenerating, so a missing hash tool stops the script
     # before it changes anything. Regenerating leaves mf.proto as it is.
     proto_hash="$(sha256 mf.proto)"
-    "$PROTOC" --plugin=protoc-gen-go="$plugin" \
+    "$PROTOC" --plugin=protoc-gen-go="$PROTOC_GEN_GO" \
         --go_out=paths=source_relative:. ./mf.proto
     echo "$proto_hash" >mf.proto.sha256
 }