Format and check markdown with prettier in make fmt and fmt-check (closes #110)

script/fmt and script/fmt-check follow the model scripts in the prompts
repo: Go as before, plus prettier over every markdown file with 4-space
tabs and proseWrap always. Prettier is pinned by hash in package.json and
yarn.lock; script/bootstrap now installs node, yarn and prettier. The
Dockerfile lint stage copies node and yarn from a node image pinned by
hash and runs script/bootstrap, so its make fmt-check fails the build on
unformatted markdown. Every markdown file is formatted once; wording is
unchanged (CLAUDE.md's "*" list markers become "-").

Model: opus-5-5

README.md

@@ -593,8 +593,10 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call them. We
 provide:
 
-- `script/bootstrap` — install all dependencies (Go, Go module download),
-  idempotently; golangci-lint is not installed, it runs in docker
+- `script/bootstrap` — install all dependencies (Go, Go module download, and
+  node, yarn and prettier for formatting markdown), idempotently; prettier is
+  pinned by hash in `package.json` and `yarn.lock`; golangci-lint is not
+  installed, it runs in docker
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (`secret`); used by other
@@ -611,8 +613,11 @@ provide:
   compiles; cgo is off, so the keychain unlocker's calls into the keychain
   (`internal/secret/keychainunlocker_cgo.go`, and `keychainunlocker_test.go`)
   and the Secure Enclave bindings (`internal/macse`) are not checked
-- `script/fmt` — format all Go code (writes)
-- `script/fmt-check` — check formatting without writing
+- `script/fmt` — format all Go code with `go fmt` and every markdown file with
+  prettier (4-space tabs, `proseWrap: always`) (writes)
+- `script/fmt-check` — check the same formatting without writing; the
+  `Dockerfile` lint stage runs it, so an unformatted Go or markdown file fails
+  the build
 - `script/check` — run `script/test`, `script/lint`, `script/lint-darwin`, and
   `script/fmt-check`
 - `script/docker` — build the Docker image tagged with the project name