Re-vendor the shared files from sneak/prompts at dd4027b (closes #52)

Takes .golangci.yml, .dockerignore, .gitignore, .editorconfig, the
workflow and REPO_POLICIES.md from sneak/prompts dd4027b, keeping this
repository's own entries after the shared content. Lint (golangci-lint
v2.14.0) and test become Dockerfile phases that script/lint and
script/test build alone and uncached; the image build depends on both,
and script/cibuild bootstraps, runs script/check, then builds the image.
The agent guidance file moves to AGENTS.md. The Go code is fixed for
what the new configuration finds; reads that iterate rows now also
report an iteration error.

Model: opus-5-5

internal/version/version.go

@@ -3,7 +3,7 @@ package version
 
 // Build-time variables set via ldflags
 //
-//nolint:gochecknoglobals // These must be variables to allow ldflags injection at build time
+//nolint:gochecknoglobals // variables so that ldflags can set them at build time
 var (
 	// GitRevision is the git commit hash
 	GitRevision = "unknown"