Add script/install; script/update-policy runs it and commits (closes #165)

script/install fetches the policy files from prompts over HTTP and
writes them into a repo, installing itself and script/update-policy
there. script/update-policy fetches the current script/install, runs
it on its own repo and commits without pushing. The file list and the
rules for keeping a repo's own entries move to script/install.

Model: opus-5-5

TODO.md

@@ -21,6 +21,11 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-11-09: `script/install` writes the vendored policy files into a repo over
+  HTTP, and installs itself and `script/update-policy` there
+  (https://git.eeqj.de/sneak/prompts/issues/165). `make update-policy` now
+  fetches the current `script/install`, runs it and commits without pushing. The
+  template repositories get both scripts in their own issues.
 - 2026-11-09: `script/update-policy` and `make update-policy` update a repo's
   vendored policy files with one command
   (https://git.eeqj.de/sneak/prompts/issues/162). They fetch the files from