Re-vendor the canonical files from sneak/prompts at dd4027b (closes #171)

.dockerignore, .gitignore, .prettierignore and REPO_POLICIES.md are
copied from sneak/prompts at dd4027b; .editorconfig, check.yml and
.prettierrc already matched. This repository's build artifacts follow
the copied content in .gitignore and, anchored, in .dockerignore. The
scripts follow the new policy: check runs fmt-check, cibuild bootstraps
and runs check before the image build, fmt and fmt-check find the
pinned yarn under nvm, and the image's last stage marks /app safe for
git. The build-context test expects the new pattern forms.

Judgement call: script/precommit runs lint and fmt-check without the tests, so the README's red-phase test commit can still land; the policy allows that form only where local testing is impossible.
Not applicable: the issue's .golangci.yml entries; this TypeScript repository has none.

Model: opus-5-5

TODO.md

@@ -25,6 +25,14 @@ declares one.
 
 # Completed Steps
 
+- 2026-10-06: The files this repository copies from `sneak/prompts` are copied
+  again from its commit `dd4027b` (issue 171). `.gitignore` and `.dockerignore`
+  keep out more secret files, and this repository's build artifacts follow the
+  copied content. `script/check` runs `script/fmt-check` again, `script/cibuild`
+  runs `script/bootstrap` and `script/check` before the image build,
+  `script/fmt` and `script/fmt-check` find the pinned yarn under nvm, and the
+  image's last stage marks `/app` safe for git.
+
 - 2026-10-06: `quak backup` writes the account and album records
   `backup-metadata` writes (issue 166): `account.json` with the account's
   `email` and `userID`, and in each album's JSON its `ownerID`, `isShared`,