Re-vendor the canonical files from sneak/prompts at dd4027b (closes #121)

The vendored files are copies from sneak/prompts dd4027b, with this
repository's own entries after the canonical content. golangci-lint is
v2.14.0. Lint and test are phases of the Dockerfile, which script/lint
and script/test build with --no-cache; Dockerfile.lint and
script/lint-darwin are gone, and the lint phase also checks the macOS
build. The tests run on the Debian Go image with cgo and the race
detector. script/cibuild bootstraps, runs script/check and builds the
image; CHECK_EPOCH and the memlock ulimit are gone. Go's build cache
stays in a cache mount, out of the test image's layer. Agent guidance
lives in AGENTS.md alone; the tool-specific file is gone.

Model: opus-5-5

README.md

@@ -604,31 +604,24 @@ provide:
 - `script/build` — build the `secret` binary into the repo root, stamping the
   version (`VERSION` from the environment, else `git describe`) and the git
   commit
-- `script/test` — run `go vet`, then the test suite with the race detector, a
-  30-second timeout per package and coverage, every test on every run, never a
-  result from Go's test cache; on failure it reruns the tests verbosely for the
-  details and fails even when the rerun passes
-- `script/lint` — run `golangci-lint` in docker only: builds `Dockerfile.lint`,
-  where the linter is a build step that runs on every call, also on an unchanged
-  tree
-- `script/lint-darwin` — run `go vet` and `golangci-lint` in docker on the code
-  as a macOS build compiles it (`GOOS=darwin`), which a Linux build never
-  compiles; cgo is off, so the keychain unlocker's calls into the keychain
+- `script/test` — build the `test` phase of the `Dockerfile`, which runs the
+  test suite with the race detector, a 90-second timeout and coverage; on
+  failure it reruns the tests verbosely for the details and fails even when the
+  rerun passes
+- `script/lint` — build the `lint` phase of the `Dockerfile`, which runs
+  `go vet` and `golangci-lint`, then both again on the code as a macOS build
+  compiles it (`GOOS=darwin`), which a Linux build never compiles; cgo is off
+  there, so the keychain unlocker's calls into the keychain
   (`internal/secret/keychainunlocker_cgo.go`, and `keychainunlocker_test.go`)
   and the Secure Enclave bindings (`internal/macse`) are not checked
 - `script/fmt` — format all Go code with `go fmt` and every markdown file with
   prettier (4-space tabs, `proseWrap: always`) (writes)
-- `script/fmt-check` — check the same formatting without writing; the
-  `Dockerfile` lint stage runs it, so an unformatted Go or markdown file fails
-  the build
-- `script/check` — run `script/test`, `script/lint`, `script/lint-darwin`, and
-  `script/fmt-check`
-- `script/docker` — build the Docker image tagged with the project name
-- `script/cibuild` — CI entrypoint: `docker build --ulimit memlock=-1:-1 .`
-  (memguard needs mlock; the Dockerfile runs the checks), with a new
-  `CHECK_EPOCH` build argument on every run so the checks run again on an
-  unchanged tree; the `Dockerfile` keeps Go's build cache between builds, so
-  `make test` and `make build` compile only what changed
+- `script/fmt-check` — check the same formatting without writing, on the host
+- `script/check` — run `script/test`, `script/lint` and `script/fmt-check`
+- `script/docker` — build the Docker image tagged with the project name; the
+  build runs the `lint` and `test` phases first
+- `script/cibuild` — CI entrypoint: runs `script/bootstrap`, `script/check`,
+  then builds the image as `script/docker` does
 - `script/precommit` — pre-commit checks: `go mod tidy` verification, then
   `script/check`
 - `script/install-precommit` — install the git pre-commit hook that runs