Re-vendor the canonical files from sneak/prompts at dd4027b (closes #171)

.dockerignore, .gitignore, .prettierignore and REPO_POLICIES.md are
copied from sneak/prompts at dd4027b; .editorconfig, check.yml and
.prettierrc already matched. This repository's build artifacts follow
the copied content in .gitignore and, anchored, in .dockerignore. The
scripts follow the new policy: check runs fmt-check, cibuild bootstraps
and runs check before the image build, fmt and fmt-check find the
pinned yarn under nvm, and the image's last stage marks /app safe for
git. The build-context test expects the new pattern forms.

Judgement call: script/precommit runs lint and fmt-check without the tests, so the README's red-phase test commit can still land; the policy allows that form only where local testing is impossible.
Not applicable: the issue's .golangci.yml entries; this TypeScript repository has none.

Model: opus-5-5

test/packaging/build-context.test.ts

@@ -29,18 +29,19 @@ const patterns = (name: string): string[] =>
 const dockerignore = patterns(".dockerignore");
 
 describe(".dockerignore", () => {
-    // Everything here is either generated, enormous, or secret. `.claude/` is
-    // the correctness one: see the header comment and issue #25.
+    // Everything here is either generated, enormous, or secret. `.claude` is
+    // the correctness one: see the header comment and issue #25. The leading
+    // `/` anchors an entry at the root of the context.
     it.each([
-        ".claude/",
-        ".quak/",
-        "bin/quak",
-        "node_modules",
-        "coverage",
-        "dist",
-        ".vitest-cache/",
-        ".nyc_output/",
-        "*.tsbuildinfo",
+        ".claude",
+        "/.quak",
+        "/bin/quak",
+        "**/node_modules",
+        "/coverage",
+        "/dist",
+        "/.vitest-cache",
+        "/.nyc_output",
+        "/*.tsbuildinfo",
     ])("keeps %s out of the build context", (pattern) => {
         expect(dockerignore).toContain(pattern);
     });
@@ -57,7 +58,7 @@ describe(".dockerignore", () => {
     // The build stage is the final image, so a .git/config sent in would
     // ship the clone's remote URL and any credential in it.
     it("sends .git without its config", () => {
-        expect(dockerignore).toContain(".git/config");
+        expect(dockerignore).toContain("**/.git/config");
     });
 
     // BuildKit lets a `Dockerfile.dockerignore` shadow the root one; such a