Rename the scripts that update the policy files

script/commit-current-upstream-policy-docs is now
script/write-upstream-policy-files: it writes the policy files and
commits nothing. script/update-policy is now
script/commit-upstream-policy-files, and make update-policy is now
make commit-upstream-policy-files. test/update-policy.sh follows.
Behaviour is unchanged.

Model: opus-5-5

script/commit-upstream-policy-files

@@ -0,0 +1,45 @@
+#!/bin/sh
+# script/commit-upstream-policy-files: bring this repo up to standards.
+# It fetches the current script/write-upstream-policy-files from the
+# prompts repo over HTTP, runs it on this repo and commits the files it
+# wrote. It does not push. Identical in all repos. Our own extension to
+# scripts-to-rule-them-all.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+WRITE_UPSTREAM_POLICY_FILES_URL="https://git.eeqj.de/sneak/prompts/raw/branch/main/script/write-upstream-policy-files"
+
+die() {
+    echo "commit-upstream-policy-files: $*" >&2
+    exit 1
+}
+
+main() {
+    [ "$#" -eq 0 ] || die "usage: script/commit-upstream-policy-files"
+
+    cd "$ROOT"
+
+    tmp="$(mktemp -d)"
+    trap 'rm -rf "$tmp"' EXIT
+
+    curl --fail --silent --show-error --max-time 60 \
+        --output "$tmp/write-upstream-policy-files" \
+        "$WRITE_UPSTREAM_POLICY_FILES_URL" ||
+        die "cannot fetch $WRITE_UPSTREAM_POLICY_FILES_URL"
+
+    sh "$tmp/write-upstream-policy-files" "$ROOT" > "$tmp/written"
+    commit="$(head -n 1 "$tmp/written")"
+    paths="$(tail -n +2 "$tmp/written")"
+
+    for path in $paths; do
+        git add -- "$path"
+    done
+
+    if git diff --cached --quiet -- $paths; then
+        echo "commit-upstream-policy-files: already at prompts $commit, nothing to commit"
+    else
+        git commit -m "Update policy files from prompts $commit" -- $paths
+    fi
+}
+
+main "$@"