Re-vendor the shared files from sneak/prompts at dd4027b (closes #52)

Takes .golangci.yml, .dockerignore, .gitignore, .editorconfig, the
workflow and REPO_POLICIES.md from sneak/prompts dd4027b, keeping this
repository's own entries after the shared content. Lint (golangci-lint
v2.14.0) and test become Dockerfile phases that script/lint and
script/test build alone and uncached; the image build depends on both,
and script/cibuild bootstraps, runs script/check, then builds the image.
The agent guidance file moves to AGENTS.md. The Go code is fixed for
what the new configuration finds; reads that iterate rows now also
report an iteration error.

Model: opus-5-5

Dockerfile

@@ -1,22 +1,37 @@
-# Lint stage — fast feedback on formatting and lint issues.
-# The golangci-lint image bundles Go, gcc and make, so it can run go vet on
-# the CGO sqlite package and golangci-lint without extra installs.
-# golangci/golangci-lint:v2.7.2 (Go 1.25.5), 2026-09-21
-FROM golangci/golangci-lint@sha256:5d6d5c70a61f1356adfd9dd6316ce286799fefc9d743421356ff1b00842368ba AS lint
-
+# Lint phase, built alone by script/lint. The linter is invoked directly
+# rather than through `make lint`, which is itself a docker build and
+# would recurse into a daemon that does not exist in a build step. The
+# image is Debian-based and has Go and gcc, so it can check the cgo
+# SQLite package without extra installs.
+# golangci/golangci-lint:v2.14.0 (Go 1.27.0), 2026-10-14
+FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 WORKDIR /src
-
 COPY go.mod go.sum ./
 RUN go mod download
-
 COPY . .
+RUN golangci-lint run --config .golangci.yml ./...
 
-RUN make fmt-check
-RUN make lint
+# Test phase, built alone by script/test. -race needs cgo and so a C
+# compiler, which the Debian Go image ships. -short skips the live RIPE RIS
+# feed test, so the suite needs no network. The rerun with -v only shows
+# details: the build fails however it ends, because the first run failed.
+# golang:1.24-bookworm, 2026-09-21
+FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS test
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN go test -short -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -short -timeout 90s -race -v ./...; exit 1; }
 
-# Build stage
+# Build stage. Nothing is wanted from the lint and test phases; the copies
+# are what make BuildKit build them first, so this stage cannot run unless
+# lint and test passed.
 # golang:1.24-bookworm, 2026-09-21
 FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS builder
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null
 
 # Install build dependencies (zstd for archive, gcc for CGO/sqlite3)
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -25,10 +40,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libc6-dev \
     && rm -rf /var/lib/apt/lists/*
 
-WORKDIR /src
+# A tar-stream context keeps the sender's file owners, which git refuses.
+RUN git config --system --add safe.directory /src
 
-# Force BuildKit to run the lint stage before compiling or testing.
-COPY --from=lint /src/go.sum /dev/null
+WORKDIR /src
 
 # Copy everything
 COPY . .
@@ -36,10 +51,6 @@ COPY . .
 # Vendor dependencies (must be after copying source)
 RUN go mod download && go mod vendor
 
-# Run the test suite in the build stage: -race needs cgo and the C compiler
-# installed above. The suite is offline (the live-feed test is opt-in).
-RUN make test
-
 # Build the binary with CGO enabled (required for sqlite3). The version the
 # page footer shows is the VERSION build argument when one is given, otherwise
 # `git describe --tags --always` of the .git in the build context (git comes