Adopt scripts-to-rule-them-all: script/ entrypoints, Makefile shims, policy update

script/precommit

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# script/precommit: run by the git pre-commit hook; fails the commit if
+# checks fail. Our own extension to scripts-to-rule-them-all.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+
+main() {
+    "$SCRIPT_DIR/check"
+}
+
+main "$@"