update-policy: stop only on a line canonical has never held

A line an earlier canonical commit held counted as the repo's own, so
the script stopped on the outdated lines a re-vendor exists to replace.
It now clones prompts and also treats every line removed from the file
in its history as canonical.

The .golangci.yml stop message no longer tells anyone to delete a line.
The tests use a local git repository in place of prompts and gain one
scenario each for .golangci.yml and .gitignore.

Model: opus-5-5

script/update-policy

@@ -11,10 +11,10 @@
 # merged. A repo's own entries are kept:
 #   - .gitignore, .editorconfig, .dockerignore: the lines below the
 #     canonical file's last line. An entry above that line which the
-#     canonical file lacks stops the script.
+#     canonical file has never held stops the script.
 #   - .golangci.yml: the entries the repo added to the deny list of the
-#     test-support rule. Any other line the canonical file lacks stops
-#     the script, unless it is blank or a comment.
+#     test-support rule. Any other line the canonical file has never
+#     held stops the script, unless it is blank or a comment.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -58,18 +58,19 @@ local_path() {
 }
 
 # local_only_lines <fetched> <local> [end]: print each line of the local
-# file, above line end if given, that the fetched file lacks. Blank
-# lines and comments do not count.
+# file, above line end if given, that the canonical file has never held:
+# not in the fetched file or in <fetched>.former, the lines earlier
+# commits removed from it. Blank lines and comments do not count.
 local_only_lines() {
-    awk -v end="${3:-}" '
-        NR == FNR { fetched[$0]; next }
-        (end == "" || FNR < end) && !/^[ \t]*(#|$)/ && !($0 in fetched)
-    ' "$1" "$2"
+    cat "$1" "$1.former" | awk -v end="${3:-}" '
+        NR == FNR { held[$0]; next }
+        (end == "" || FNR < end) && !/^[ \t]*(#|$)/ && !($0 in held)
+    ' - "$2"
 }
 
 # keep_lines_below_last <fetched> <local>: append to the fetched file
-# whatever follows its last line in the local file. Stop if a line above
-# that one is missing from the fetched file, unless it is blank or a
+# whatever follows its last line in the local file. Stop if the canonical
+# file has never held a line above that one, unless it is blank or a
 # comment: replacing the file would delete it.
 keep_lines_below_last() {
     last="$(tail -n 1 "$1")"
@@ -88,8 +89,9 @@ $own"
 # keep_deny_entries <fetched> <local>: add to the deny list of the
 # test-support rule in the fetched file the entries only the local file
 # has. An entry is a "- pkg:" line, the lines under it and any comment
-# above it. Stop if the local file still has a line the result lacks,
-# unless it is blank or a comment: replacing the file would delete it.
+# above it. Stop if the local file still has a line that neither the
+# result nor the canonical file has ever held, unless it is blank or a
+# comment: replacing the file would delete it.
 keep_deny_entries() {
     awk '
         function indent(line) { return match(line, /[^ ]/) - 1 }
@@ -143,7 +145,7 @@ keep_deny_entries() {
     mv "$1.merged" "$1"
     own="$(local_only_lines "$1" "$2")"
     if [ -n "$own" ]; then
-        die "$2 has lines the canonical file lacks; add each to the canonical file to keep it, or delete it:
+        die "$2 has lines the canonical file has never held; only the deny list of the test-support rule may differ from canonical:
 $own"
     fi
 }
@@ -169,6 +171,9 @@ main() {
     tmp="$(mktemp -d)"
     trap 'rm -rf "$tmp"' EXIT
 
+    git clone --quiet --bare "$PROMPTS_URL.git" "$tmp/prompts.git" ||
+        die "cannot clone $PROMPTS_URL.git"
+
     carried=""
     for file in $VENDORED_FILES; do
         path="$(local_path "$file")"
@@ -181,6 +186,8 @@ main() {
             --output "$tmp/$path" \
             "$PROMPTS_URL/raw/commit/$commit/$file" ||
             die "cannot fetch $file at $commit"
+        git -C "$tmp/prompts.git" log -p --format= "$commit" -- "$file" |
+            sed -n 's/^-//p' > "$tmp/$path.former"
         carried="$carried $path"
     done
     [ -n "$carried" ] || die "this repo carries none of the vendored files"