Re-vendor the shared files from sneak/prompts at dd4027b (closes #113)

The shared files are the sneak/prompts copies at dd4027b, with this
repository's own entries after them. make lint and make test each build
one phase of the Dockerfile without the cache, and each covers the
frontend through a node stage; the builder stage waits on both and takes
its version from git describe unless VERSION is given. golangci-lint
moves to v2.14.0 with the new .golangci.yml, and one test spells
X-Request-ID as canonicalheader asks. prettier formats only JavaScript,
CSS, HTML and Markdown, so the shared .golangci.yml stays as fetched.
script/fmt and script/fmt-check put ~/.local/bin on PATH, which the
shared workflow no longer does.

Model: opus-5-5

script/bootstrap

@@ -6,8 +6,9 @@
 # used directly if it is at least NODE_MIN_VERSION; otherwise it is
 # installed at a pinned version via nvm (installing nvm itself first,
 # from a hash-verified release archive, never curl | sh). Go, with its
-# gofmt, is used directly only if it is exactly GO_VERSION; otherwise
-# that release is installed from its hash-verified archive.
+# gofmt, is used directly if it is at least the version backend/go.mod
+# asks for; otherwise the pinned Go release is installed from its
+# hash-verified archive.
 #
 # What this script installs outside the system package manager lives
 # under $HOME and is linked into ~/.local/bin, where make and the git
@@ -185,29 +186,20 @@ ensure_yarn() {
 }
 
 # go_ok: the go on PATH has its gofmt beside it (a Go release ships the
-# two together) and go version reports exactly GO_VERSION, compared over
-# the whole version, not a prefix of it. A go that fails or prints
-# anything else does not pass. GOTOOLCHAIN=local makes go report itself
-# rather than a toolchain it would fetch.
+# two together) and is at least the version backend/go.mod asks for.
+# GOTOOLCHAIN=local makes an older go fail here instead of fetching a
+# newer toolchain for itself.
 go_ok() {
     if missing go; then return 1; fi
     [ -x "$(dirname "$(command -v go)")/gofmt" ] || return 1
-    case "$(GOTOOLCHAIN=local go version 2>/dev/null)" in
-        "go version go$GO_VERSION "*) return 0 ;;
-        *) return 1 ;;
-    esac
+    (cd "$ROOT/backend" && GOTOOLCHAIN=local go list -m >/dev/null 2>&1)
 }
 
 # ensure_go: unless go_ok, install GO_VERSION and link its go and gofmt.
 # They are linked on every run that needs them, so a deleted link is put
 # back, and the archive is unpacked again if either binary is missing.
-# Afterwards go is looked up through PATH again and must pass go_ok, so
-# another go that hides the link stops bootstrap.
 ensure_go() {
-    if go_ok; then
-        echo "bootstrap: using $(GOTOOLCHAIN=local go version)"
-        return 0
-    fi
+    if go_ok; then return 0; fi
     go_dir="$TOOLCHAIN/go-$GO_VERSION"
     if [ ! -x "$go_dir/bin/go" ] || [ ! -x "$go_dir/bin/gofmt" ]; then
         # sha256 of each archive, from https://go.dev/dl/?mode=json
@@ -248,13 +240,6 @@ ensure_go() {
     fi
     link_bin "$go_dir/bin/go" go
     link_bin "$go_dir/bin/gofmt" gofmt
-    hash -r
-    if ! go_ok; then
-        echo "bootstrap: after installing go $GO_VERSION in $go_dir," >&2
-        echo "  the go on PATH, $(command -v go), is not it or has no gofmt" >&2
-        exit 1
-    fi
-    echo "bootstrap: installed $(GOTOOLCHAIN=local go version)"
 }
 
 main() {