Re-vendor the canonical files from sneak/prompts dd4027b (closes #159, closes #116)

Fetches .dockerignore, .editorconfig, the CI workflow, .gitignore,
.golangci.yml, .prettierignore, .prettierrc and REPO_POLICIES.md byte
for byte from sneak/prompts dd4027b, keeping this repo's anchored
host-built artifacts in .dockerignore; the new .golangci.yml disables
gomodguard. The Dockerfile gets a lint phase on golangci-lint v2.14.0
and a test phase on the Debian Go image; the build stage depends on
both and stamps the version as the policy shows. script/test and
script/lint build only their phase, and script/cibuild bootstraps and
runs script/check first. bin/tools goes: script/bootstrap installs
gofumpt and protoc-gen-go into bin/ with go install pinned to a commit,
and bin/.gitignore ignores what lands in bin/.

Model: opus-5-5

script/test

@@ -1,17 +1,19 @@
 #!/bin/sh
-# script/test: run the test suite.
+# script/test: run the test suite. Testing is a phase of the Dockerfile
+# and this builds that phase alone, on the same terms as script/lint:
+# --target because a phase that is not the last stage is built only when
+# named, --no-cache because a cached test layer is a test that did not
+# run, and a tag so each build replaces the previous image.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -timeout 30s -race -cover ./... ||
-        {
-            echo "--- Rerunning with -v for details ---"
-            go test -timeout 30s -race -v ./...
-            exit 1
-        }
+    docker build --no-cache \
+        --target test \
+        -t "$("$SCRIPT_DIR/projectname")-test" .
 }
 
 main "$@"