Re-vendor the shared files from sneak/prompts at dd4027b (closes #52)

Takes .golangci.yml, .dockerignore, .gitignore, .editorconfig, the
workflow and REPO_POLICIES.md from sneak/prompts dd4027b, keeping this
repository's own entries after the shared content. Lint (golangci-lint
v2.14.0) and test become Dockerfile phases that script/lint and
script/test build alone and uncached; the image build depends on both,
and script/cibuild bootstraps, runs script/check, then builds the image.
The agent guidance file moves to AGENTS.md. The Go code is fixed for
what the new configuration finds; reads that iterate rows now also
report an iteration error.

Model: opus-5-5

TODO.md

@@ -10,8 +10,9 @@
 
 # Status
 
-pre-1.0. No git tags. The Docker build runs the format check, the linter
-and the tests, and the Gitea workflow runs that build on every push. The
+pre-1.0. No git tags. The linter and the tests are phases of the Docker
+build, and the Gitea workflow runs `script/cibuild` (the format check, both
+phases, then the image) on every push. The
 image sets memory ceilings for a 5 GiB container (README "Memory") and the
 README says how to run it under upaas (README "Running under upaas"). A
 35-hour run of `3898daa` on the live feed peaked at about 1 GiB, without a
@@ -27,6 +28,10 @@ real 5 GiB limit (https://git.eeqj.de/sneak/routewatch/issues/3).
 
 # Completed Steps
 
+- 2026-10-14: the shared files are re-vendored from `sneak/prompts` at
+  `dd4027b`: golangci-lint v2.14.0 and its configuration, lint and test as
+  separate uncached Dockerfile phases, agent guidance in `AGENTS.md`; the code
+  is fixed for what the new linter configuration finds (closes #52)
 - 2026-10-03: `/api/v1/stats` serves the prefix distribution from memory,
   seeded at startup and adjusted on every live-route write, so a request no
   longer reads every live route (closes #30)