policy: name script/check as the gate repo-type verifications belong in

The rule put repo-type-specific extras such as `go mod tidy`
verification in `script/precommit`. `script/precommit` is one caller of
`script/check`, not the gate: a check placed there alone runs only for
contributors who installed the hook, and never in CI. Naming
`script/check` instead puts the check on every path that already funnels
through it, including the Dockerfile build step and therefore CI, with
the pre-commit hook inheriting it.

Records the read-only constraint that placement implies, since
`make check` must not modify files.

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-08-19
+last_modified: 2026-08-20
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -69,8 +69,15 @@ style conventions are in separate documents:
   outputs the project's name. Scripts that need the name call
   `script/projectname` — e.g. `script/docker` assembles its image tag from it —
   so those scripts stay byte-identical across all repos. Repo-type-specific
-  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/precommit`, not in the hook itself. Model scripts are at
+  verifications (e.g. `go mod tidy` verification in Go repos) belong in
+  `script/check`, which is the gate the other entrypoints funnel through: it
+  runs in the Dockerfile build step and therefore in CI, and `script/precommit`
+  inherits it by calling `script/check`. In `script/precommit` alone such a
+  check binds only the contributors who installed the hook, and the hook file
+  itself stays a shim that carries no checks of its own. Anything added to
+  `script/check` must be read-only, since `make check` must not modify files, so
+  use a verify or diff mode (`go mod tidy -diff`) rather than a command that
+  rewrites the tree. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
   must document the provided scripts in an **Entrypoints** section (see the
   README requirements below).
@@ -263,14 +270,11 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
-- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
-  _NEVER_ be modified by an agent: fetch it from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
-  byte-identical, so that no repo can quietly loosen its own linting. Linter
-  configuration changes are made to the canonical copy in the `prompts` repo and
-  reach consuming repos by re-vendoring; an agent may open a PR against
-  canonical, which only the user merges. The canonical golangci-lint version is
-  v2.12.2 (released 2026-05-06), installed commit-pinned via
+- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
+  manually by the user. Fetch from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`. The
+  canonical golangci-lint version is v2.12.2 (released 2026-05-06), installed
+  commit-pinned via
   `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5`.
 
 - When pinning images or packages by hash, add a comment above the reference