Add script/update-policy to re-vendor policy files (closes #162)

One command fetches the policy files a repo vendors from `prompts`, keeps the repo's own entries, commits them by name and pushes. A line the canonical file has never held stops the script before anything is written, as does a failed fetch. The canonical `.dockerignore` gains the closing comment the script needs. `test/update-policy.sh` runs in the `test` phase of `Dockerfile`.

Judgement call: `.gitea/workflows/check.yml` and `.prettierrc` are replaced whole.
Limitation: a repo with its own `.golangci.yml` settings, such as `sneak/homoicon`, stops until those are dealt with.

Model: opus-5-5

Dockerfile

@@ -42,7 +42,7 @@ RUN script/bootstrap
 
 COPY . .
 
-RUN echo "No tests defined."
+RUN timeout 90 test/update-policy.sh
 
 # Development environment, and the last stage: a plain `docker build .`
 # names no target and so builds this one. Nothing is wanted from the two