Re-vendor the shared files from sneak/prompts at dd4027b (closes #113)

The shared files are the sneak/prompts copies at dd4027b, with this
repository's own entries after them. make lint and make test each build
one phase of the Dockerfile without the cache, and each covers the
frontend through a node stage; the builder stage waits on both and takes
its version from git describe unless VERSION is given. golangci-lint
moves to v2.14.0 with the new .golangci.yml, and one test spells
X-Request-ID as canonicalheader asks. prettier formats only JavaScript,
CSS, HTML and Markdown, so the shared .golangci.yml stays as fetched.
script/fmt and script/fmt-check put ~/.local/bin on PATH, which the
shared workflow no longer does.

Model: opus-5-5

backend/script/lint

@@ -1,50 +1,13 @@
 #!/bin/sh
-# script/lint: run golangci-lint over the backend. This runs inside the
-# lint stage of the root Dockerfile, whose digest-pinned golangci-lint
-# image provides the linter; nothing installs golangci-lint on the host.
-# From a checkout, run `make lint` at the repo root, which builds that
-# stage.
-#
-# .golangci.yml is standardized org-wide and must never be edited here
-# (REPO_POLICIES.md). Its last silent drift replaced the v2 schema with
-# v1 keys, which left every threshold in the file inert while the build
-# stayed green. So the file is first checked against the canonical
-# copy's sha256: a local comparison, no network, nothing unpinned.
+# script/lint: lint the whole repo as the root make lint does, by
+# building the lint phase of the root Dockerfile. golangci-lint never
+# runs on the host (REPO_POLICIES.md).
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# The sha256 of the org standard .golangci.yml. When that file changes in
-# sneak/prompts and is copied here again, this changes with it.
-GOLANGCI_CONFIG_SHA256="a79b63a254602a5318db5d0e9a06bc71b84bf0c1d896305229d8bfed1d1b1776"
+ROOT="$(cd "$(dirname "$0")/../.." && pwd -P)"
 
 main() {
-    cd "$ROOT"
-    if [ ! -f .golangci.yml ]; then
-        echo "backend/.golangci.yml is missing. Copy the org standard verbatim" >&2
-        echo "from https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml" >&2
-        exit 1
-    fi
-    actual="$(sha256sum .golangci.yml | cut -d' ' -f1)"
-    if [ -z "$actual" ]; then
-        echo "sha256sum is missing or printed no hash, so" >&2
-        echo "backend/.golangci.yml could not be checked." >&2
-        exit 1
-    fi
-    if [ "$actual" != "$GOLANGCI_CONFIG_SHA256" ]; then
-        echo "backend/.golangci.yml does not match GOLANGCI_CONFIG_SHA256" >&2
-        echo "in backend/script/lint." >&2
-        echo "  expected $GOLANGCI_CONFIG_SHA256" >&2
-        echo "  actual   $actual" >&2
-        echo "Compare it with the org standard," >&2
-        echo "https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml" >&2
-        echo "- If they differ, it was edited here: restore the org standard" >&2
-        echo "  verbatim. Do not edit it." >&2
-        echo "- If they are the same, the org standard changed: set" >&2
-        echo "  GOLANGCI_CONFIG_SHA256 in backend/script/lint to the actual hash." >&2
-        exit 1
-    fi
-    golangci-lint run ./...
+    exec "$ROOT/script/lint"
 }
 
 main "$@"