Re-vendor the canonical files from sneak/prompts at 0653579 (closes #221)

REPO_POLICIES.md, script/cibuild, script/docker, script/lint and
script/test are their copies at that commit. In every Dockerfile stage
the system package install and the Go module download now come before
ARG CACHEBUST, so check builds keep those layers until the base image,
the install line, go.mod or go.sum change. golangci-lint run also
mounts golangci-lint's cache. The test phase and the build stage
install their packages with apt-get and apk directly, as
REPO_POLICIES.md now has them do, instead of through
script/bootstrap --cgo. The test phase installs no recommended
packages and names libheif's AVIF encoder, libheif-plugin-aomenc,
which the tests use.

Model: opus-5-5

TODO.md

@@ -30,6 +30,10 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-18 re-vendored from `sneak/prompts` commit `0653579` (closes #221):
+  each `Dockerfile` stage installs its system packages and downloads the Go
+  modules above `ARG CACHEBUST`, so check builds keep them, and the lint step
+  keeps golangci-lint's cache.
 - 2026-10-18 the next reconciliation pass waits at least ten times as long as
   the last one took, so passes on a large cache no longer run back to back
   (closes #250).