Re-vendor the shared files from sneak/prompts at dd4027b (closes #52)

Takes .golangci.yml, .dockerignore, .gitignore, .editorconfig, the
workflow and REPO_POLICIES.md from sneak/prompts dd4027b, keeping this
repository's own entries after the shared content. Lint (golangci-lint
v2.14.0) and test become Dockerfile phases that script/lint and
script/test build alone and uncached; the image build depends on both,
and script/cibuild bootstraps, runs script/check, then builds the image.
The agent guidance file moves to AGENTS.md. The Go code is fixed for
what the new configuration finds; reads that iterate rows now also
report an iteration error.

Model: opus-5-5

internal/metrics/metrics.go

@@ -115,9 +115,11 @@ func (t *Tracker) GetStreamMetrics() StreamMetrics {
 	if msgCount >= 0 {
 		totalMessages = uint64(msgCount)
 	}
+
 	if byteCount >= 0 {
 		totalBytes = uint64(byteCount)
 	}
+
 	if wireByteCount >= 0 {
 		totalWireBytes = uint64(wireByteCount)
 	}
@@ -161,7 +163,7 @@ func (t *Tracker) RecordWithdrawal() {
 func (t *Tracker) SetBGPPeerCount(count int) {
 	// BGP peer count is always small (< 1000), so int32 is safe
 	if count > 0 && count < 1<<31 {
-		t.bgpPeerCount.Store(int32(count)) //nolint:gosec // count is validated
+		t.bgpPeerCount.Store(int32(count))
 	}
 }
 
@@ -209,7 +211,8 @@ type StreamMetrics struct {
 	TotalMessages uint64
 	// TotalBytes is the total number of decompressed bytes received since startup
 	TotalBytes uint64
-	// TotalWireBytes is the total number of bytes received on the wire (before decompression)
+	// TotalWireBytes is the total number of bytes received on the wire (before
+	// decompression)
 	TotalWireBytes uint64
 	// ConnectedSince is the time when the current connection was established
 	ConnectedSince time.Time
@@ -217,9 +220,11 @@ type StreamMetrics struct {
 	Connected bool
 	// MessagesPerSec is the rate of messages received per second (1-minute average)
 	MessagesPerSec float64
-	// BitsPerSec is the rate of decompressed bits received per second (1-minute average)
+	// BitsPerSec is the rate of decompressed bits received per second (1-minute
+	// average)
 	BitsPerSec float64
-	// WireBitsPerSec is the rate of bits received on the wire per second (1-minute average)
+	// WireBitsPerSec is the rate of bits received on the wire per second
+	// (1-minute average)
 	WireBitsPerSec float64
 	// ReconnectCount is the number of reconnections since startup
 	ReconnectCount uint64