Re-vendor the shared files from sneak/prompts at 0653579 (closes #52)

Takes .golangci.yml, .dockerignore, .gitignore, .editorconfig, the
workflow and REPO_POLICIES.md from sneak/prompts 0653579, with this
repository's own entries after the shared content. Lint (golangci-lint
v2.14.0) and test are Dockerfile phases that script/lint and script/test
build alone with a new CACHEBUST value, keeping Go's and golangci-lint's
caches; the image build depends on both. make fmt and make fmt-check also
format the markdown with prettier, pinned in yarn.lock. The agent
guidance moves to AGENTS.md. The Go code is fixed for what the new
configuration finds, and the AS and prefix detail reads now return the
rows' error after their loops.

Model: opus-5-5

Dockerfile

@@ -1,20 +1,44 @@
-# Lint stage — fast feedback on formatting and lint issues.
-# The golangci-lint image bundles Go, gcc and make, so it can run go vet on
-# the CGO sqlite package and golangci-lint without extra installs.
-# golangci/golangci-lint:v2.7.2 (Go 1.25.5), 2026-09-21
-FROM golangci/golangci-lint@sha256:5d6d5c70a61f1356adfd9dd6316ce286799fefc9d743421356ff1b00842368ba AS lint
+# In every stage ARG CACHEBUST comes right after the steps that install
+# system packages and download Go's modules, or right after FROM in a
+# stage with neither, and every step that lints, tests or compiles
+# comes after it. script/ passes a new value on every build, which
+# reruns every RUN step after it. Docker keeps the layers above it
+# until the base image, their own lines or go.mod and go.sum change.
+# The steps that compile mount Go's build cache, and golangci-lint run
+# also mounts golangci-lint's; both survive from build to build.
 
+# Lint phase. The image is Debian-based and has gcc, so it can check the
+# cgo SQLite package without extra installs.
+# golangci/golangci-lint:v2.14.0 (Go 1.27.0), 2026-10-19
+FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 WORKDIR /src
-
 COPY go.mod go.sum ./
 RUN go mod download
-
+ARG CACHEBUST
 COPY . .
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/root/.cache/golangci-lint \
+    golangci-lint run --config .golangci.yml ./...
 
-RUN make fmt-check
-RUN make lint
+# Test phase. -race needs cgo and so a C compiler, which the Debian Go
+# image ships and the alpine one does not. -count=1 because the mounted
+# cache also holds test results, which go test would otherwise replay.
+# -short skips the live RIS Live feed test, so the suite needs no network.
+# golang:1.24-bookworm, 2026-09-21
+FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS test
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+ARG CACHEBUST
+COPY . .
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    go test -short -count=1 -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -short -count=1 -timeout 90s -race -v ./...; exit 1; }
 
-# Build stage
+# Build stage. Nothing is wanted from either phase above; the copies
+# are what make BuildKit build them first, so nothing after them can
+# run unless lint and test passed.
 # golang:1.24-bookworm, 2026-09-21
 FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS builder
 
@@ -26,36 +50,38 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /src
-
-# Force BuildKit to run the lint stage before compiling or testing.
+COPY go.mod go.sum ./
+RUN go mod download
+ARG CACHEBUST
 COPY --from=lint /src/go.sum /dev/null
-
-# Copy everything
+COPY --from=test /src/go.sum /dev/null
+# A tar-stream context keeps the sender's file owners, which git refuses.
+RUN git config --system --add safe.directory /src
 COPY . .
 
-# Vendor dependencies (must be after copying source)
-RUN go mod download && go mod vendor
-
-# Run the test suite in the build stage: -race needs cgo and the C compiler
-# installed above. The suite is offline (the live-feed test is opt-in).
-RUN make test
+# Vendor dependencies for the source archive (must be after copying source)
+RUN go mod vendor
 
 # Build the binary with CGO enabled (required for sqlite3). The version the
-# page footer shows is the VERSION build argument when one is given, otherwise
-# `git describe --tags --always` of the .git in the build context (git comes
-# with this image): the tag on a tagged commit, tag-N-gHASH after one, the
-# short commit when no tag is reachable. A context that carries .git and still
-# yields no version fails the build. The footer links to the full commit.
+# page footer shows is the VERSION build arg when one is given, otherwise
+# `git describe --tags --always` on the .git in the build context: the tag
+# on a tagged commit, tag-N-gHASH after one, the short commit when no tag is
+# reachable. With .git present, a version that is still empty, dev or
+# unknown fails the build: git is missing or could not read the checkout.
+# Without .git the footer says unknown. The footer links to the full commit.
 ARG VERSION
-RUN version="${VERSION:-$(git describe --tags --always || echo unknown)}"; \
-    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
-        [ "$version" = unknown ]; }; then \
-        echo "no version could be derived although the build context carries .git" >&2; \
-        exit 1; \
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    VERSION="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ]; then \
+        case "$VERSION" in ""|dev|unknown) \
+            echo "version is '$VERSION' although .git is present" >&2; \
+            exit 1 ;; \
+        esac; \
     fi; \
+    REVISION="$(git rev-parse --verify HEAD || echo unknown)"; \
     CGO_ENABLED=1 GOOS=linux go build -o /routewatch -ldflags "\
-        -X git.eeqj.de/sneak/routewatch/internal/version.GitRevision=$(git rev-parse --verify HEAD || echo unknown) \
-        -X git.eeqj.de/sneak/routewatch/internal/version.GitRevisionShort=$version" \
+        -X git.eeqj.de/sneak/routewatch/internal/version.GitRevision=$REVISION \
+        -X git.eeqj.de/sneak/routewatch/internal/version.GitRevisionShort=${VERSION:-unknown}" \
         ./cmd/routewatch
 
 # Create source archive with vendored dependencies
@@ -64,7 +90,7 @@ RUN tar --zstd -cf /routewatch-source.tar.zst \
     --exclude='*.tar.zst' \
     .
 
-# Runtime stage
+# Runtime stage, and the last one
 # debian:bookworm-slim, 2026-09-21
 FROM debian@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251
 
@@ -76,6 +102,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
+ARG CACHEBUST
+
 # Create non-root user
 RUN useradd -r -u 1000 -m routewatch