Add script/update-policy to re-vendor policy files (closes #162)

One command fetches the vendored files from prompts at a commit, keeps a repo's own entries, commits and pushes. An entry above a file's closing comment that the canonical file lacks stops it before it writes. A run with nothing to commit still pushes, so a retry delivers a failed push. The canonical .dockerignore gains the closing comment the script needs. test/update-policy.sh tests the script in the Dockerfile test phase.

Model: opus-5-5

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks
+.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks update-policy
 
 # Makefile targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -30,3 +30,6 @@ docker:
 
 hooks:
 	@script/install-precommit
+
+update-policy:
+	@script/update-policy