Re-vendor the shared files from sneak/prompts at dd4027b (closes #113)

The shared files are the sneak/prompts copies at dd4027b, with this
repository's own entries after them. make lint and make test each build
one Dockerfile phase without the cache, both covering the frontend
through a node stage; the builder stage waits on both and takes its
version from git describe unless VERSION is given. golangci-lint moves
to v2.14.0 with the new .golangci.yml; one test spells X-Request-ID as
canonicalheader asks. prettier formats only JavaScript, CSS, HTML and
Markdown, so .golangci.yml stays as fetched. script/fmt and
script/fmt-check put ~/.local/bin on PATH, which the shared workflow no
longer does. script/bootstrap keeps a Go only if it is exactly
GO_VERSION, and re-checks the go on PATH after installing.

Model: opus-5-5

backend/README.md

@@ -28,20 +28,21 @@ docker run -p 8080:8080 netwatch
 This directory follows the same
 [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
 pattern as the repo root: the targets in `backend/Makefile` are thin shims over
-`backend/script/`. The root `Dockerfile` runs them, and the root scripts call
-`test`, `fmt` and `fmt-check`:
+`backend/script/`. The root `Dockerfile` runs `build`, and the root scripts call
+`fmt` and `fmt-check`:
 
 - `script/build` — compile the static `netwatch-server` binary with its version
   stamped in. The version is `VERSION` from the environment; when that is unset
   or empty, it falls back to `git describe` inside a git checkout, then to `dev`
-- `script/test` — run the Go tests with the race detector and coverage. Go's
-  `-timeout 30s` bounds the tests, not their compile. If they fail, they run
-  again with `-v` for the details, and the script fails. The race detector needs
-  a C compiler
-- `script/lint` — check `.golangci.yml` against its pinned sha256, then run
-  golangci-lint. It runs inside the golangci-lint image of the lint stage of the
-  root `Dockerfile`; from a checkout, run `make lint` at the repo root, which
-  builds that stage
+- `script/test` — run the Go tests on the host with the race detector and
+  coverage; the root `make test` runs them in the `test` phase of the root
+  `Dockerfile`. Go's `-timeout 90s` bounds the tests, not their compile, and
+  `-count=1` keeps Go from reporting a stored pass. If they fail, they run again
+  with `-v` for the details, and the script fails. The race detector needs a C
+  compiler
+- `script/lint` — run the root `script/lint`, which builds the `lint` phase of
+  the root `Dockerfile`: golangci-lint over this directory, and eslint over the
+  frontend. golangci-lint never runs on the host
 - `script/fmt` — format the Go sources (writes)
 - `script/fmt-check` — check Go formatting (read-only)
 - `script/run` — build and run the server locally