Add script/install; script/update-policy runs it and commits (closes #165)

script/install fetches the policy files from prompts over HTTP and
writes them into a repo, installing itself and script/update-policy
there. script/update-policy fetches the current script/install, runs
it on its own repo and commits without pushing. The file list and the
rules for keeping a repo's own entries move to script/install.

Model: opus-5-5

prompts/EXISTING_REPO_CHECKLIST.md

@@ -205,17 +205,19 @@ with your task.
 - [ ] `Makefile` exists in root — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`
 - [ ] Has targets: `test`, `lint`, `fmt`, `fmt-check`, `check`, `docker`,
-      `hooks`, `update-policy`
+      `hooks`, `install`, `update-policy`
 - [ ] Target implementations live in `script/` (scripts-to-rule-them-all);
       Makefile targets are thin shims calling them — model scripts at
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`
 - [ ] `script/precommit` exists and the pre-commit hook (installed by
       `script/install-precommit`, shimmed by `make hooks`) runs it
-- [ ] `script/update-policy` exists, identical to the model script, and
-      `make update-policy` shims to it. Before its first use, the repo's own
-      entries in `.gitignore`, `.editorconfig` and `.dockerignore` go below the
-      comment that ends each canonical file. An entry above that comment which
-      the canonical file has never held makes the script stop before it writes
+- [ ] `script/install` and `script/update-policy` exist, identical to the model
+      scripts, and `make install` and `make update-policy` shim to them.
+      `make update-policy` commits without pushing, so a person reviews and
+      pushes the commit. Before its first use, the repo's own entries in
+      `.gitignore`, `.editorconfig` and `.dockerignore` go below the comment
+      that ends each canonical file. An entry above that comment which the
+      canonical file has never held makes the script stop before it writes
       anything, naming the file and the entry. It stops the same way on a line
       in `.golangci.yml` that the canonical file has never held, apart from
       comments and the repo's entries in the `deny` list of the `test-support`

prompts/NEW_REPO_CHECKLIST.md

@@ -266,9 +266,12 @@ are thin shims calling them. Model scripts:
 - [ ] `script/install-precommit` — installs the pre-commit hook that runs
       `script/precommit`
 - [ ] `make hooks` — shims to `script/install-precommit`
-- [ ] `script/update-policy` / `make update-policy` — fetches the vendored
-      policy files from the `prompts` repo, commits them and pushes; identical
+- [ ] `script/install` / `make install` — fetches the vendored policy files from
+      the `prompts` repo over HTTP and writes them into the repo; identical
       across repos
+- [ ] `script/update-policy` / `make update-policy` — fetches the current
+      `script/install`, runs it on the repo and commits the result without
+      pushing; identical across repos
 - [ ] README **Entrypoints** section documents the scripts and links the
       standard
 

prompts/REPO_POLICIES.md

@@ -93,8 +93,8 @@ style conventions are in separate documents:
     - `make check` (runs `test`, `lint`, `fmt-check`)
     - `make docker`
     - `make hooks` (installs pre-commit hook)
-    - `make update-policy` (fetches the vendored policy files, commits and
-      pushes)
+    - `make install` (writes the current policy files into the repo)
+    - `make update-policy` (brings the repo up to standards and commits)
 
     A model Makefile is at
     `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
@@ -111,6 +111,7 @@ style conventions are in separate documents:
     - `script/fmt-check`
     - `script/check`
     - `script/docker`
+    - `script/install`
     - `script/update-policy`
 
     The scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they
@@ -185,15 +186,18 @@ style conventions are in separate documents:
     host. On a pristine checkout with nothing installed, the run dies there,
     after the containerised gates have passed.
 
-    Five further scripts are our own extensions to the standard:
+    Six further scripts are our own extensions to the standard:
     - `script/check` runs `script/test`, `script/lint` and `script/fmt-check`.
     - `script/precommit` is what the git pre-commit hook runs, and it calls
       `script/check`.
     - `script/install-precommit` installs the git pre-commit hook. The
       `make hooks` target shims to it.
-    - `script/update-policy` fetches the vendored policy files from the
-      `prompts` repo, commits them and pushes. The `make update-policy` target
-      shims to it.
+    - `script/install` fetches the vendored policy files from the `prompts` repo
+      over HTTP and writes them into the repo it is given, or its own repo with
+      no argument. The `make install` target shims to it.
+    - `script/update-policy` fetches the current `script/install` from the
+      `prompts` repo, runs it on its own repo and commits the result. It does
+      not push. The `make update-policy` target shims to it.
     - `script/projectname` (literally that filename) simply outputs the
       project's name.
 
@@ -933,12 +937,18 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
-- A repo updates its policy files with one command: `make update-policy`. It
-  runs `script/update-policy`, which fetches each vendored file the repo carries
-  from the `prompts` repo, commits them and pushes. It uses the head of `main`,
-  or the commit given by a full hash: `script/update-policy <hash>`. The list of
-  vendored files is at the top of that script. The script replaces each file and
-  keeps only the repo's own entries:
+- One command brings a repo up to standards: `make update-policy`. It runs
+  `script/update-policy`, which fetches the current `script/install` from the
+  head of `main` in the `prompts` repo and runs it on the repo. It then commits
+  the files that changed and does not push, so a person reviews and pushes the
+  commit.
+
+    `script/install` fetches each vendored file the repo carries from `prompts`
+    over HTTP. It also installs `script/install` and `script/update-policy` in
+    the repo, so a repo updated once can update itself. Every repo made from a
+    template repo already has both. The list of vendored files is at the top of
+    `script/install`. The script replaces each file and keeps only the repo's
+    own entries:
     - in `.gitignore`, `.editorconfig` and `.dockerignore`: the lines below the
       comment that ends the canonical file
     - in `.golangci.yml`: the entries the repo added to the `deny` list of the
@@ -1169,7 +1179,7 @@ style conventions are in separate documents:
     - `Makefile`
     - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
       `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
-      `install-precommit`, `update-policy`)
+      `install-precommit`, `install`, `update-policy`)
     - `Dockerfile`, `.dockerignore`
     - `.gitea/workflows/check.yml`
     - Go: `go.mod`, `go.sum`, `.golangci.yml`