Configure prettier and make fmt-check cover markdown (closes #69)

Adds .prettierrc and .prettierignore, a single script/prettier entrypoint shared by fmt and fmt-check so the two cannot drift, and prettier 3.9.6 pinned by yarn.lock integrity hash.

Markdown formatting is now gated in the authoritative Docker build via a new mdfmt stage, since the golangci-lint image has no node. REPO_POLICIES.md is ignored so local tooling cannot drift it from upstream.

Removes the || true that made the previous prettier invocation unable to fail.

script/fmt

@@ -2,7 +2,8 @@
 # script/fmt: format all files (writes).
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 # Regenerate mfer/mf.pb.go from mfer/mf.proto if it is missing or stale
 # (mirrors the old Makefile prerequisite; the generated file is
@@ -19,9 +20,8 @@ main() {
     ensure_pb
     gofumpt -l -w mfer internal cmd
     golangci-lint run --fix
-    # prettier is best-effort, as in the old Makefile (- prefix)
-    prettier -w *.json || true
-    prettier -w *.md || true
+    # Markdown and JSON, over the same file set script/fmt-check verifies.
+    "$SCRIPT_DIR/prettier" --write
 }
 
 main "$@"