Keep Go's build cache in check builds: re-vendor sneak/prompts e3f79c4 (closes #129)

The vendored files are copies from sneak/prompts e3f79c4, with this
repository's own entries kept. The script/ builds pass a new CACHEBUST
value instead of --no-cache, which emptied Go's build cache mount, so
every make test compiled the standard library and every dependency with
-race. Every Dockerfile stage declares ARG CACHEBUST first, so every RUN
step still reruns on an unchanged tree. The steps that compile mount
Go's build cache, and both go test runs keep -count=1. The lint and test
builds write no image. script/bootstrap, script/fmt and script/fmt-check
are the canonical files plus this repository's Go steps.

Model: opus-5-5

TODO.md

@@ -17,6 +17,18 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-15: The canonical files are re-vendored from `sneak/prompts` commit
+  `e3f79c4` (https://git.eeqj.de/sneak/secret/issues/129), so Go's build cache
+  survives between check builds and `make test` no longer compiles the standard
+  library and every dependency with `-race` on every run. `script/lint`,
+  `script/test`, `script/cibuild` and `script/docker` pass a new `CACHEBUST`
+  value instead of `--no-cache`, and every stage of the `Dockerfile` declares
+  `ARG CACHEBUST` first, so every `RUN` step still reruns on an unchanged tree.
+  The steps that compile mount Go's build cache, and both `go test` runs keep
+  `-count=1`, so no test result is reused. `script/lint` and `script/test` write
+  no image. The CI workflow cancels a branch's older run, stops after 20
+  minutes, fetches the tags and leaves no token behind. `script/bootstrap` uses
+  the installed node only when its major version is the pinned one.
 - 2026-10-15: `secret mv` from one vault to another unlocks both vaults before
   it takes the state directory lock
   (https://git.eeqj.de/sneak/secret/issues/189). It unlocked them while holding