Re-vendor the shared files from sneak/prompts at dd4027b (closes #52)

Takes .golangci.yml, .dockerignore, .gitignore, .editorconfig, the
workflow and REPO_POLICIES.md from sneak/prompts dd4027b, keeping this
repository's own entries after the shared content. Lint (golangci-lint
v2.14.0) and test become Dockerfile phases that script/lint and
script/test build alone and uncached; the image build depends on both,
and script/cibuild bootstraps, runs script/check, then builds the image.
The agent guidance file moves to AGENTS.md. The Go code is fixed for
what the new configuration finds; reads that iterate rows now also
report an iteration error.

Model: opus-5-5

README.md

@@ -273,24 +273,30 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call
 them. We provide:
 
-- `script/bootstrap` — install all development dependencies (go,
-  golangci-lint, Go module download)
+Tests and the linter run only in Docker, as the `test` and `lint` phases of the
+`Dockerfile`; the image cannot be built unless both pass. Every `docker build`
+in `script/` passes `--no-cache`, so each run executes every check.
+
+- `script/bootstrap` — install all development dependencies (git, make, go, Go
+  module download); warns when docker is missing
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — print the project name (used for the Docker
   image tag)
-- `script/test` — run the test suite
-  (`go test -short -timeout 30s -race -cover ./...`, verbose rerun on
-  failure). The `-short` flag skips the live-network integration test so the
-  default run is deterministic and offline.
-- `script/lint` — run `go vet ./...` and `golangci-lint run`
+- `script/test` — build the `test` phase alone, which runs
+  `go test -short -timeout 90s -race -cover ./...` (verbose rerun on failure).
+  The `-short` flag skips the live-network integration test so the run is
+  deterministic and offline.
+- `script/lint` — build the `lint` phase alone, which runs golangci-lint
+  v2.14.0 with `.golangci.yml`
 - `script/fmt` — format all code (writes)
 - `script/fmt-check` — check formatting (read-only)
 - `script/check` — run `script/test`, `script/lint`, and
   `script/fmt-check`
 - `script/docker` — build the Docker image tagged via
   `script/projectname`
-- `script/cibuild` — CI entrypoint: `docker build .`
+- `script/cibuild` — CI entrypoint: runs `script/bootstrap` and
+  `script/check`, then builds the image
 - `script/precommit` — pre-commit gate: `go mod tidy` + `go fmt` (must
   not change files), then `script/check`
 - `script/install-precommit` — install the git pre-commit hook that