script/install: do not stop on a missing closing comment

A .gitignore or .dockerignore lacking the canonical last line no longer
stops the script: each line the canonical file has never held goes
below the fetched content. An .editorconfig lacking it is replaced,
unless it has such a line, which stops the script.

The stub curl now writes files with no execute bit, as a real download
does, so the tests exercise the mode the script sets.

Model: opus-5-5

prompts/EXISTING_REPO_CHECKLIST.md

@@ -214,15 +214,18 @@ with your task.
 - [ ] `script/install` and `script/update-policy` exist, identical to the model
       scripts, and `make update-policy` shims to `script/update-policy`.
       `make update-policy` commits without pushing, so a person reviews and
-      pushes the commit. Before its first use, the repo's own entries in
-      `.gitignore`, `.editorconfig` and `.dockerignore` go below the comment
-      that ends each canonical file. An entry above that comment which the
-      canonical file has never held makes the script stop before it writes
-      anything, naming the file and the entry. It stops the same way on a line
-      in `.golangci.yml` that the canonical file has never held, apart from
-      comments and the repo's entries in the `deny` list of the `test-support`
-      rule. It also stops on a repo's own `script/install` or
-      `script/update-policy`.
+      pushes the commit. A `.gitignore` or `.dockerignore` without the comment
+      that ends the canonical file needs no preparation. The script moves each
+      line the canonical file has never held to below the canonical content.
+      Blank lines and comments are dropped. Before its first use, add that
+      comment to an `.editorconfig` that has lines of its own, and put those
+      lines below it. Otherwise the script stops before it writes anything,
+      naming the file and each line. In a file that has the comment, an entry
+      above it which the canonical file has never held also stops the script. It
+      stops the same way on a line in `.golangci.yml` that the canonical file
+      has never held, apart from comments and the repo's entries in the `deny`
+      list of the `test-support` rule. It also stops on a repo's own
+      `script/install` or `script/update-policy`.
 - [ ] README has an **Entrypoints** section documenting the `script/`
       entrypoints and linking the standard
 - [ ] `script/lint` and `script/test` each run