Add script/update-policy to re-vendor policy files (closes #162)

One command fetches the vendored files from prompts at a commit, keeps a repo's own entries, commits and pushes. The canonical .dockerignore gains the closing comment the script needs.

Model: opus-5-5

README.md

@@ -141,6 +141,9 @@ alpine. We provide:
   `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own
   extension); `make hooks` shims to it
+- `script/update-policy` — fetch the vendored policy files from this repo,
+  commit them and push (our own extension); it is for the repos that vendor them
+  and stops when run here
 
 `make hooks` installs the pre-commit hook that runs `script/precommit`.