Re-vendor the canonical files from sneak/prompts dd4027b (closes #159, closes #116)

Fetches .dockerignore, .editorconfig, the CI workflow, .gitignore,
.golangci.yml, .prettierignore, .prettierrc and REPO_POLICIES.md byte
for byte from sneak/prompts dd4027b; this repo's own entries follow the
canonical text in .dockerignore, .gitignore and .editorconfig. The new
.golangci.yml disables gomodguard. The Dockerfile gets a lint phase on
golangci-lint v2.14.0 and a test phase on the Debian Go image; the
build stage depends on both and stamps the version as the policy shows.
script/test and script/lint build only their phase, and script/cibuild
bootstraps and runs script/check first. bin/tools goes: script/bootstrap
installs gofumpt and protoc-gen-go into bin/ with go install pinned to a
commit.

Model: opus-5-5

script/bootstrap

@@ -22,6 +22,14 @@ YARN_VERSION="1.22.22"
 # protoc v33.4, 2026-10-04, for script/generate. The sha256 of each
 # platform's release archive is in ensure_protoc.
 PROTOC_VERSION="33.4"
+# gofumpt v0.12.0 for script/gofumpt and protoc-gen-go v1.36.11 for
+# script/generate, 2026-10-04: each is installed into bin/ with
+# `go install`, pinned to the commit its release tag names. Those two
+# scripts refuse any other version, so a new pin is changed there too.
+GOFUMPT_VERSION="v0.12.0"
+GOFUMPT_COMMIT="3e07e7e70ac93761d8e79ca0083a19e3d59f753d"
+PROTOC_GEN_GO_VERSION="v1.36.11"
+PROTOC_GEN_GO_COMMIT="96a179180f0ad6bba9b1e7b6e38d0affb0168e9a"
 
 PKGMGR=""
 SUDO=""
@@ -130,11 +138,13 @@ install_js_deps() {
 
 # Unpack protoc's release archive for this platform into bin/protoc, after
 # checking the archive's sha256, unless bin/protoc already holds the pinned
-# version.
+# version. script/generate runs bin/protoc/bin/protoc, so that is the
+# binary checked again after unpacking.
 ensure_protoc() {
     dir="$ROOT/bin/protoc"
     if [ "$("$dir/bin/protoc" --version 2>/dev/null)" = \
         "libprotoc $PROTOC_VERSION" ]; then
+        echo "protoc $PROTOC_VERSION"
         return 0
     fi
     case "$(uname -s) $(uname -m)" in
@@ -168,6 +178,53 @@ ensure_protoc() {
     rm -rf "$dir"
     unzip -q "$tmp/protoc.zip" -d "$dir"
     rm -rf "$tmp"
+    actual="$("$dir/bin/protoc" --version 2>/dev/null || true)"
+    if [ "$actual" != "libprotoc $PROTOC_VERSION" ]; then
+        echo "bootstrap: $dir/bin/protoc reports '$actual'," \
+            "not libprotoc $PROTOC_VERSION" >&2
+        exit 1
+    fi
+    echo "protoc $PROTOC_VERSION"
+}
+
+# Install gofumpt into bin/ unless bin/gofumpt already reports the pinned
+# version. script/gofumpt runs bin/gofumpt, so that is the binary checked
+# again after installing. Its --version prints the version, then the Go
+# version it was built with. The old file is removed first because
+# `go install` refuses to replace a file that is not a Go binary.
+ensure_gofumpt() {
+    tool="$ROOT/bin/gofumpt"
+    if [ "$("$tool" --version 2>/dev/null | cut -d' ' -f1)" != \
+        "$GOFUMPT_VERSION" ]; then
+        rm -f "$tool"
+        GOBIN="$ROOT/bin" go install "mvdan.cc/gofumpt@$GOFUMPT_COMMIT"
+    fi
+    actual="$("$tool" --version 2>/dev/null | cut -d' ' -f1)"
+    if [ "$actual" != "$GOFUMPT_VERSION" ]; then
+        echo "bootstrap: $tool reports '$actual', not $GOFUMPT_VERSION" >&2
+        exit 1
+    fi
+    echo "gofumpt $GOFUMPT_VERSION"
+}
+
+# Install protoc-gen-go into bin/ unless bin/protoc-gen-go already reports
+# the pinned version, as ensure_gofumpt does. script/generate runs
+# bin/protoc-gen-go, so that is the binary checked again after installing.
+ensure_protoc_gen_go() {
+    tool="$ROOT/bin/protoc-gen-go"
+    if [ "$("$tool" --version 2>/dev/null)" != \
+        "protoc-gen-go $PROTOC_GEN_GO_VERSION" ]; then
+        rm -f "$tool"
+        GOBIN="$ROOT/bin" go install \
+            "google.golang.org/protobuf/cmd/protoc-gen-go@$PROTOC_GEN_GO_COMMIT"
+    fi
+    actual="$("$tool" --version 2>/dev/null || true)"
+    if [ "$actual" != "protoc-gen-go $PROTOC_GEN_GO_VERSION" ]; then
+        echo "bootstrap: $tool reports '$actual'," \
+            "not protoc-gen-go $PROTOC_GEN_GO_VERSION" >&2
+        exit 1
+    fi
+    echo "protoc-gen-go $PROTOC_GEN_GO_VERSION"
 }
 
 main() {
@@ -192,10 +249,9 @@ main() {
     if missing go; then pkg_install go golang go go; fi
     # No golangci-lint: script/lint runs it in Docker only.
     go mod download
-    # gofumpt and protoc-gen-go: bin/tools/go.mod pins them, and
-    # script/gofumpt and script/generate build them from there.
-    (cd "$ROOT/bin/tools" && go mod download)
+    ensure_gofumpt
     ensure_protoc
+    ensure_protoc_gen_go
 
     # ---- Python repos ----
     # if missing python3; then pkg_install python3 python3 python3 python3; fi