Adopt scripts-to-rule-them-all: script/ entrypoints, Makefile shims, policy update (#23)

Reviewed-on: #23
Co-authored-by: sneak <sneak@sneak.berlin>
Co-committed-by: sneak <sneak@sneak.berlin>

prompts/NEW_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-02-22
+last_modified: 2026-07-06
 ---
 
 Use this checklist when creating a new repository from scratch. Follow the steps
@@ -57,7 +57,7 @@ Template files can be fetched from:
     - Non-server: brings up dev environment and runs `make check`
     - Image pinned by sha256 hash with version/date comment
 - [ ] Gitea Actions workflow at `.gitea/workflows/check.yml` that runs
-      `docker build .` on push — reference
+      `script/cibuild` on push — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific:
     - [ ] Go: `go mod init sneak.berlin/go/<name>`, `.golangci.yml` (fetch from
@@ -65,15 +65,39 @@ Template files can be fetched from:
     - [ ] JS: `yarn init`, `yarn add --dev prettier`
     - [ ] Python: `pyproject.toml`
 
-## Configure Makefile
+## Configure script/ Entrypoints and Makefile
 
-- [ ] `make test` — runs real tests, not a no-op (30-second timeout)
-- [ ] `make lint` — runs linter
-- [ ] `make fmt` — formats code (writes)
-- [ ] `make fmt-check` — checks formatting (read-only)
-- [ ] `make check` — prereqs: `test`, `lint`, `fmt-check`; must not modify files
-- [ ] `make docker` — builds Docker image
-- [ ] `make hooks` — installs pre-commit hook
+Implementations live in `script/` (scripts-to-rule-them-all); Makefile targets
+are thin shims calling them. Model scripts:
+`https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`
+
+- [ ] scripts are POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run on
+      alpine images without bash
+- [ ] `script/bootstrap` / `make bootstrap` — installs all dependencies,
+      idempotently, assuming nothing (pkg manager detection nix/apt/brew/apk;
+      node used if present, else pinned version via nvm from a hash-verified
+      archive; pinned yarn via corepack); Dockerfile runs it instead of inline
+      installs
+- [ ] `script/setup` / `make setup` — readies a fresh clone: runs `bootstrap`,
+      then `install-precommit`, plus repo-specific init
+- [ ] `script/test` / `make test` — runs real tests, not a no-op (30-second
+      timeout)
+- [ ] `script/lint` / `make lint` — runs linter
+- [ ] `script/fmt` / `make fmt` — formats code (writes)
+- [ ] `script/fmt-check` / `make fmt-check` — checks formatting (read-only)
+- [ ] `script/check` / `make check` — runs `test`, `lint`, `fmt-check`; must not
+      modify files
+- [ ] `script/projectname` — outputs the project name (used by `script/docker`
+      for the image tag)
+- [ ] `script/docker` / `make docker` — builds Docker image, tagged via
+      `script/projectname` (byte-identical across repos)
+- [ ] `script/cibuild` — cd to repo root, `docker build .` (what CI runs)
+- [ ] `script/precommit` — called by the pre-commit hook; runs `script/check`
+- [ ] `script/install-precommit` — installs the pre-commit hook that runs
+      `script/precommit`
+- [ ] `make hooks` — shims to `script/install-precommit`
+- [ ] README **Entrypoints** section documents the scripts and links the
+      standard
 
 # 4. Verify