Add script/update-policy to re-vendor policy files (closes #162)

One command fetches the vendored files from prompts at a commit, keeps a repo's own entries, commits and pushes. The canonical .dockerignore gains the closing comment the script needs.

Model: opus-5-5

.dockerignore

@@ -76,3 +76,7 @@
 **/.idea
 **/.vscode
 **/*.sublime-*
+
+# This repository's own entries, such as its build outputs, go below
+# this comment, and a re-vendor keeps them. Anchor a binary built at the
+# root: `/myapp`, never `**/myapp`, which also matches `cmd/myapp/`.