Add script/update-policy to re-vendor policy files (closes #162)

One command fetches the vendored files from prompts at a commit, keeps a repo's own entries, commits and pushes. An entry above a file's closing comment that the canonical file lacks stops it before it writes. A run with nothing to commit still pushes, so a retry delivers a failed push. The canonical .dockerignore gains the closing comment the script needs. test/update-policy.sh tests the script in the Dockerfile test phase.

Model: opus-5-5

README.md

@@ -118,8 +118,8 @@ alpine. We provide:
   `script/docker` for the image tag
 - `script/test` —
   `docker build --build-arg CACHEBUST="$(date +%s)-$$" --target test --output type=cacheonly .`,
-  building the `test` phase of the `Dockerfile` without writing an image (no
-  tests defined here)
+  building the `test` phase of the `Dockerfile`, which runs
+  `test/update-policy.sh`, without writing an image
 - `script/lint` —
   `docker build --build-arg CACHEBUST="$(date +%s)-$$" --target lint --output type=cacheonly .`,
   building the `lint` phase, which runs prettier over the markdown files,
@@ -141,6 +141,9 @@ alpine. We provide:
   `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own
   extension); `make hooks` shims to it
+- `script/update-policy` — fetch the vendored policy files from this repo,
+  commit them and push (our own extension); it is for the repos that vendor them
+  and stops when run here
 
 `make hooks` installs the pre-commit hook that runs `script/precommit`.