Add script/update-policy to re-vendor policy files (closes #162)

One command fetches the vendored files from prompts at a commit, keeps a repo's own entries, commits and pushes. An entry above a file's closing comment that the canonical file lacks stops it before it writes. A run with nothing to commit still pushes, so a retry delivers a failed push. The canonical .dockerignore gains the closing comment the script needs. test/update-policy.sh tests the script in the Dockerfile test phase.

Model: opus-5-5

TODO.md

@@ -21,6 +21,12 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-11-09: `script/update-policy` and `make update-policy` update a repo's
+  vendored policy files with one command
+  (https://git.eeqj.de/sneak/prompts/issues/162). They fetch the files from
+  `prompts`, keep the repo's own entries, commit and push. The canonical
+  `.dockerignore` now ends with the comment that the repo's own entries go
+  below. The template repositories get the script in their own issues.
 - 2026-11-07: Go code is now formatted with `gofmt` and then `golines -m 77`
   (https://git.eeqj.de/sneak/prompts/issues/160). `prompts/REPO_POLICIES.md`
   says how `script/fmt`, `script/fmt-check` and `script/bootstrap` do it and