Configure prettier and make fmt-check cover markdown (closes #69)

Adds .prettierrc and .prettierignore, a single script/prettier entrypoint shared by fmt and fmt-check so the two cannot drift, and prettier 3.9.6 pinned by yarn.lock integrity hash.

Markdown formatting is now gated in the authoritative Docker build via a new mdfmt stage, since the golangci-lint image has no node. REPO_POLICIES.md is ignored so local tooling cannot drift it from upstream.

Removes the || true that made the previous prettier invocation unable to fail.

Dockerfile

@@ -11,15 +11,32 @@ COPY . .
 # Touch .pb.go so make does not try to regenerate via protoc (file is committed)
 RUN touch mfer/mf.pb.go
 
-RUN make fmt-check
+# Go half of fmt-check only: this image has no node, so no prettier. The
+# markdown half runs in the mdfmt stage below.
+RUN make fmt-check-go
 RUN make lint
 
+# Markdown/JSON format stage — prettier needs node, which the Go images
+# do not have. node:22.17.0-bookworm-slim (2026-08-09); ships node
+# 22.17.0 and yarn 1.22.22, the versions script/bootstrap pins.
+FROM node@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0 AS mdfmt
+
+WORKDIR /src
+COPY package.json yarn.lock ./
+RUN yarn install --frozen-lockfile
+
+COPY . .
+
+# No make in this image; call the script entrypoint directly.
+RUN script/prettier --check
+
 # Build stage — tests and compilation
 # golang:1.23 (2026-03-14)
 FROM golang@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS builder
 
-# Force BuildKit to run the lint stage by creating a stage dependency
+# Force BuildKit to run the lint and mdfmt stages by creating stage dependencies
 COPY --from=lint /src/go.sum /dev/null
+COPY --from=mdfmt /src/go.sum /dev/null
 
 WORKDIR /src
 COPY go.mod go.sum ./