Re-vendor the shared files from sneak/prompts at dd4027b (closes #113)

The shared files are the sneak/prompts copies at dd4027b, with this
repository's own entries after them. make lint and make test each build
one phase of the Dockerfile without the cache, and each covers the
frontend through a node stage; the builder stage waits on both and takes
its version from git describe unless VERSION is given. golangci-lint
moves to v2.14.0 with the new .golangci.yml, and one test spells
X-Request-ID as canonicalheader asks. prettier formats only JavaScript,
CSS, HTML and Markdown, so the shared .golangci.yml stays as fetched.
script/fmt and script/fmt-check put ~/.local/bin on PATH, which the
shared workflow no longer does.

Model: opus-5-5

backend/README.md

@@ -28,20 +28,21 @@ docker run -p 8080:8080 netwatch
 This directory follows the same
 [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
 pattern as the repo root: the targets in `backend/Makefile` are thin shims over
-`backend/script/`. The root `Dockerfile` runs them, and the root scripts call
-`test`, `fmt` and `fmt-check`:
+`backend/script/`. The root `Dockerfile` runs `build`, and the root scripts call
+`fmt` and `fmt-check`:
 
 - `script/build` — compile the static `netwatch-server` binary with its version
   stamped in. The version is `VERSION` from the environment; when that is unset
   or empty, it falls back to `git describe` inside a git checkout, then to `dev`
-- `script/test` — run the Go tests with the race detector and coverage. Go's
-  `-timeout 30s` bounds the tests, not their compile. If they fail, they run
-  again with `-v` for the details, and the script fails. The race detector needs
-  a C compiler
-- `script/lint` — check `.golangci.yml` against its pinned sha256, then run
-  golangci-lint. It runs inside the golangci-lint image of the lint stage of the
-  root `Dockerfile`; from a checkout, run `make lint` at the repo root, which
-  builds that stage
+- `script/test` — run the Go tests on the host with the race detector and
+  coverage; the root `make test` runs them in the `test` phase of the root
+  `Dockerfile`. Go's `-timeout 90s` bounds the tests, not their compile, and
+  `-count=1` keeps Go from reporting a stored pass. If they fail, they run again
+  with `-v` for the details, and the script fails. The race detector needs a C
+  compiler
+- `script/lint` — run the root `script/lint`, which builds the `lint` phase of
+  the root `Dockerfile`: golangci-lint over this directory, and eslint over the
+  frontend. golangci-lint never runs on the host
 - `script/fmt` — format the Go sources (writes)
 - `script/fmt-check` — check Go formatting (read-only)
 - `script/run` — build and run the server locally