Re-vendor the canonical files from sneak/prompts at e3f79c4 (closes #221)

The vendored dotfiles, REPO_POLICIES.md and the standard scripts are
fetched from sneak/prompts commit e3f79c4, with pixa's own entries kept
after the standard part. The scripts pass a new CACHEBUST build argument
in place of --no-cache and every Dockerfile stage declares it first, so
every RUN step reruns while Go's build cache, mounted on the steps that
compile, is kept. The lint phase runs golangci-lint v2.14.0, the test
phase runs on the Debian Go image, and the build stage takes the version
as the policy gives it. The two new lint findings are fixed in the code.

Model: opus-5-5

script/lint

@@ -5,9 +5,12 @@
 # make its answer untrustworthy.
 #
 # The phase is not the last stage in the file, so it is built only when
-# --target names it. --no-cache because a cached lint layer is a lint
-# that did not run. The tag makes each build replace the previous image
-# instead of leaving a dangling one behind.
+# --target names it. A new CACHEBUST value reruns every RUN step, since
+# a cached lint layer is a lint that did not run; unlike --no-cache, it
+# keeps Go's build cache. This relies on every stage of the Dockerfile
+# declaring ARG CACHEBUST first; a stage without that line is served
+# from cache on an unchanged tree, with no warning.
+# --output type=cacheonly writes no image, since nothing uses one.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -15,9 +18,9 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build --no-cache \
+    docker build --build-arg CACHEBUST="$(date +%s)-$$" \
         --target lint \
-        -t "$("$SCRIPT_DIR/projectname")-lint" .
+        --output type=cacheonly .
 }
 
 main "$@"