Add script/update-policy to re-vendor policy files (closes #162)

One command fetches the policy files a repo vendors from `prompts`, keeps the repo's own entries, commits them by name and pushes. A line the canonical file has never held stops the script before anything is written, as does a failed fetch. The canonical `.dockerignore` gains the closing comment the script needs. `test/update-policy.sh` runs in the `test` phase of `Dockerfile`.

Judgement call: `.gitea/workflows/check.yml` and `.prettierrc` are replaced whole.
Limitation: a repo with its own `.golangci.yml` settings, such as `sneak/homoicon`, stops until those are dealt with.

Model: opus-5-5

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-11-07
+last_modified: 2026-11-09
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -93,6 +93,8 @@ style conventions are in separate documents:
     - `make check` (runs `test`, `lint`, `fmt-check`)
     - `make docker`
     - `make hooks` (installs pre-commit hook)
+    - `make update-policy` (fetches the vendored policy files, commits and
+      pushes)
 
     A model Makefile is at
     `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
@@ -109,6 +111,7 @@ style conventions are in separate documents:
     - `script/fmt-check`
     - `script/check`
     - `script/docker`
+    - `script/update-policy`
 
     The scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they
     run in minimal containers; alpine images, for example, have no bash. Locate
@@ -182,12 +185,15 @@ style conventions are in separate documents:
     host. On a pristine checkout with nothing installed, the run dies there,
     after the containerised gates have passed.
 
-    Four further scripts are our own extensions to the standard:
+    Five further scripts are our own extensions to the standard:
     - `script/check` runs `script/test`, `script/lint` and `script/fmt-check`.
     - `script/precommit` is what the git pre-commit hook runs, and it calls
       `script/check`.
     - `script/install-precommit` installs the git pre-commit hook. The
       `make hooks` target shims to it.
+    - `script/update-policy` fetches the vendored policy files from the
+      `prompts` repo, commits them and pushes. The `make update-policy` target
+      shims to it.
     - `script/projectname` (literally that filename) simply outputs the
       project's name.
 
@@ -927,6 +933,17 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
+- A repo updates its policy files with one command: `make update-policy`. It
+  runs `script/update-policy`, which fetches each vendored file the repo carries
+  from the `prompts` repo, commits them and pushes. It uses the head of `main`,
+  or the commit given by a full hash: `script/update-policy <hash>`. The list of
+  vendored files is at the top of that script. The script replaces each file and
+  keeps only the repo's own entries:
+    - in `.gitignore`, `.editorconfig` and `.dockerignore`: the lines below the
+      comment that ends the canonical file
+    - in `.golangci.yml`: the entries the repo added to the `deny` list of the
+      `test-support` depguard rule
+
 - `.golangci.yml` is standardized. The vendored copy in a consuming repo must
   _NEVER_ be modified by an agent. Fetch it from
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
@@ -1152,7 +1169,7 @@ style conventions are in separate documents:
     - `Makefile`
     - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
       `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
-      `install-precommit`)
+      `install-precommit`, `update-policy`)
     - `Dockerfile`, `.dockerignore`
     - `.gitea/workflows/check.yml`
     - Go: `go.mod`, `go.sum`, `.golangci.yml`