Re-vendor the canonical files from sneak/prompts dd4027b (closes #159, closes #116)

Fetches .dockerignore, .editorconfig, the CI workflow, .gitignore,
.golangci.yml, .prettierignore, .prettierrc and REPO_POLICIES.md byte
for byte from sneak/prompts dd4027b; this repo's own entries follow the
canonical text in .dockerignore, .gitignore and .editorconfig. The new
.golangci.yml disables gomodguard. The Dockerfile gets a lint phase on
golangci-lint v2.14.0 and a test phase on the Debian Go image; the
build stage depends on both and stamps the version as the policy shows.
script/test and script/lint build only their phase, and script/cibuild
bootstraps and runs script/check first. bin/tools goes: script/bootstrap
installs gofumpt and protoc-gen-go into bin/ with go install pinned to a
commit.

Model: opus-5-5

Dockerfile

@@ -1,74 +1,62 @@
-# Lint stage — fast feedback on formatting and lint issues
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
-
+# Lint phase. The linter is invoked directly rather than through `make
+# lint` or `script/lint`, which are themselves a docker build and would
+# recurse into a daemon that does not exist in a build step.
+# golangci/golangci-lint:v2.14.0, 2026-09-24
+FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
-
 COPY . .
-
-# Go half of fmt-check only: this image has no node, so no prettier. The
-# markdown half runs in the mdfmt stage below. The image has no gofumpt
-# either; script/gofumpt builds the version bin/tools/go.mod pins.
-RUN script/gofumpt --check
-# The linter directly, not `make lint`: script/lint builds this stage, and
-# there is no docker inside this build.
 RUN golangci-lint run --config .golangci.yml ./...
 
-# Markdown/JSON format stage — prettier needs node, which the Go images
-# do not have. node:22.17.0-bookworm-slim (2026-08-09); ships node
-# 22.17.0 and yarn 1.22.22, the versions .nvmrc and script/bootstrap pin.
-FROM node@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0 AS mdfmt
-
-WORKDIR /src
-COPY package.json yarn.lock ./
-RUN yarn install --frozen-lockfile
-
-COPY . .
-
-# No make in this image; call the script entrypoint directly.
-RUN script/prettier --check
-
-# Build stage — tests and compilation
+# Test phase. -race needs cgo and so a C compiler, which the Debian Go
+# image ships and the alpine one does not.
 # golang:1.23.12, 2026-03-14
-FROM golang@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS builder
-
-# Force BuildKit to run the lint and mdfmt stages by creating stage dependencies
-COPY --from=lint /src/go.sum /dev/null
-COPY --from=mdfmt /src/go.sum /dev/null
-
+FROM golang@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS test
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
+COPY . .
+RUN go test -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -timeout 90s -race -v ./...; exit 1; }
 
+# Build stage. Nothing is wanted from either phase above; the copies
+# are what make BuildKit build them first, so this stage cannot run
+# unless lint and test passed. The Debian Go image ships git, which the
+# version step below needs.
+# golang:1.23.12, 2026-03-14
+FROM golang@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS builder
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null
+# A tar-stream context keeps the sender's file owners, which git refuses.
+RUN git config --system --add safe.directory /src
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
 COPY . .
 
-RUN make test
-
-# A build context sent as a tar archive, as upaas sends it, keeps its files'
-# owners, and git refuses to read a checkout owned by another user.
-RUN git config --system --add safe.directory /src
-
-# The revision `mfer version` prints, stamped into main.Gitrev: the VERSION
-# build argument when one is given (script/docker passes one), otherwise
-# `git describe --tags --always` of the .git the build context carries: the
-# tag on a tagged commit, tag-N-gHASH on a commit after one, the short commit
-# when no tag is reachable. git ships in this base image. A context that
-# carries .git and still yields no version fails the build.
+# The revision `mfer version` prints, stamped into main.Gitrev: the
+# VERSION build arg when one is given, otherwise `git describe --tags
+# --always` on the .git in the build context. With .git present, a
+# version that is still empty, dev or unknown fails the build: git is
+# missing or could not read the checkout.
 ARG VERSION
-RUN version="${VERSION:-$(git describe --tags --always)}"; \
-    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
-        [ "$version" = unknown ]; }; then \
-        echo "no version could be derived although the build context carries .git" >&2; \
-        exit 1; \
+RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ]; then \
+        case "$VERSION" in ""|dev|unknown) \
+            echo "version is '$VERSION' although .git is present" >&2; \
+            exit 1 ;; \
+        esac; \
     fi; \
-    cd cmd/mfer && \
-    CGO_ENABLED=0 go build -ldflags "-X main.Gitrev=$version" -o /mfer .
+    CGO_ENABLED=0 go build -trimpath \
+        -ldflags="-s -w -X main.Gitrev=${VERSION}" \
+        -o /mfer ./cmd/mfer/
 
 # Fail unless /mfer is statically linked: scratch has no C library to run it.
 RUN ldd /mfer 2>&1 | grep -q 'not a dynamic executable'
 
+# Runtime stage, and the last one.
 FROM scratch
 # scratch has no CA certificates; fetch needs them to verify HTTPS servers.
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/