Re-vendor the shared files from sneak/prompts at dd4027b (closes #52)

Takes .golangci.yml, .dockerignore, .gitignore, .editorconfig, the
workflow and REPO_POLICIES.md from sneak/prompts dd4027b, keeping this
repository's own entries after the shared content. Lint (golangci-lint
v2.14.0) and test become Dockerfile phases that script/lint and
script/test build alone and uncached; the image build depends on both,
and script/cibuild bootstraps, runs script/check, then builds the image.
The agent guidance file moves to AGENTS.md. The Go code is fixed for
what the new configuration finds; reads that iterate rows now also
report an iteration error.

Model: opus-5-5

internal/database/utils.go

@@ -27,6 +27,7 @@ func prefixMaskLength(prefix string) (int, error) {
 	if err != nil {
 		return 0, fmt.Errorf("invalid prefix %s: %w", prefix, err)
 	}
+
 	maskLength, _ := network.Mask.Size()
 
 	return maskLength, nil