Re-vendor the canonical files from sneak/prompts at dd4027b (closes #121)

The vendored files are copies from sneak/prompts dd4027b, with this
repository's own entries after the canonical content. golangci-lint is
v2.14.0. Lint and test are phases of the Dockerfile, which script/lint
and script/test build with --no-cache; Dockerfile.lint and
script/lint-darwin are gone, and the lint phase also checks the macOS
build. The tests run on the Debian Go image with cgo and the race
detector. script/cibuild bootstraps, runs script/check and builds the
image; CHECK_EPOCH and the memlock ulimit are gone. Go's build cache
stays in a cache mount, out of the test image's layer. Agent guidance
lives in AGENTS.md alone; the tool-specific file is gone.

Model: opus-5-5

script/lint

@@ -1,24 +1,23 @@
 #!/bin/sh
-# script/lint: run the linter, in docker only. Builds Dockerfile.lint,
-# where golangci-lint runs as a build step.
+# script/lint: run the linter. Linting is a phase of the Dockerfile and
+# this builds that phase alone; the linter is never installed or run on
+# a developer host, where a shared result cache and a host-global lock
+# make its answer untrustworthy.
 #
-# A cached build lints nothing, so --no-cache-filter rebuilds the lint
-# stage on every run, an unchanged tree included. It ignores a stage name
-# that does not exist, so --target names the same stage: a rename then
-# fails the build instead of serving the lint from cache. cacheonly keeps
-# no image; only the build's success matters.
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. --no-cache because a cached lint layer is a lint
+# that did not run. The tag makes each build replace the previous image
+# instead of leaving a dangling one behind.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build \
-        --progress=plain \
+    docker build --no-cache \
         --target lint \
-        --no-cache-filter=lint \
-        --output=type=cacheonly \
-        -f Dockerfile.lint .
+        -t "$("$SCRIPT_DIR/projectname")-lint" .
 }
 
 main "$@"