Re-vendor the shared files from sneak/prompts at dd4027b (closes #113)

The shared files are the sneak/prompts copies at dd4027b, with this
repository's own entries after them. make lint and make test each build
one Dockerfile phase without the cache, both covering the frontend
through a node stage; the builder stage waits on both and takes its
version from git describe unless VERSION is given. golangci-lint moves
to v2.14.0 with the new .golangci.yml; one test spells X-Request-ID as
canonicalheader asks. prettier formats only JavaScript, CSS, HTML and
Markdown, so .golangci.yml stays as fetched. script/fmt and
script/fmt-check put ~/.local/bin on PATH, which the shared workflow no
longer does. script/bootstrap keeps a Go only if it is exactly
GO_VERSION, and re-checks the go on PATH after installing.

Model: opus-5-5

Dockerfile

@@ -62,17 +62,13 @@ RUN yarn build
 # ships and the alpine one does not. -timeout 90s is a backstop above
 # the 60-second cap on the suite. The rerun with -v only shows details:
 # the step fails however it ends, because the first run already failed.
-# Go's module and build caches are in memory (tmpfs) for the go test
-# step alone, so the image make test tags does not carry them and the
-# build spends no time writing them into it. They start empty on every
-# build, so no stored test result can stand in for a run.
 # golang:1.25.7-trixie, 2026-10-07
 FROM golang@sha256:2b174ffcf56c7ad0c47d30d2630693265639ddf2a5141149c2da34db921791b4 AS test
 WORKDIR /src
+COPY backend/go.mod backend/go.sum ./
+RUN go mod download
 COPY backend/ .
-RUN --mount=type=tmpfs,target=/go/pkg/mod \
+RUN go test -timeout 90s -race -cover ./... || \
-    --mount=type=tmpfs,target=/root/.cache/go-build \
-    go test -timeout 90s -race -cover ./... || \
     { echo "--- Rerunning with -v for details ---"; \
       go test -timeout 90s -race -v ./...; exit 1; }
 # Nothing is wanted from the frontend stage; the copy is what makes