Re-vendor the canonical files from sneak/prompts at dd4027b (closes #121)

The vendored files are copies from sneak/prompts dd4027b, with this
repository's own entries after the canonical content. golangci-lint is
v2.14.0. Lint and test are phases of the Dockerfile, which script/lint
and script/test build with --no-cache; Dockerfile.lint and
script/lint-darwin are gone, and the lint phase also checks the macOS
build. The tests run on the Debian Go image with cgo and the race
detector. script/cibuild bootstraps, runs script/check and builds the
image; CHECK_EPOCH and the memlock ulimit are gone. Go's build cache
stays in a cache mount, out of the test image's layer. The rules in
CLAUDE.md that AGENTS.md lacked are now in AGENTS.md.

Model: opus-5-5

TODO.md

@@ -18,6 +18,18 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-07: The canonical files are re-vendored from `sneak/prompts` commit
+  `dd4027b` (https://git.eeqj.de/sneak/secret/issues/121), with golangci-lint
+  v2.14.0 in the lint phase. Lint and test are phases of the `Dockerfile`, and
+  `script/lint` and `script/test` each build one with `--no-cache`;
+  `Dockerfile.lint` and `script/lint-darwin` are gone, and the lint phase runs
+  `go vet` and checks the macOS build too. The tests run on the Debian Go image
+  with cgo and the race detector, with the policy's 90-second timeout.
+  `script/cibuild` bootstraps, runs `script/check` and builds the image;
+  `CHECK_EPOCH` and the memlock ulimit are gone. `--no-cache` starts Go's build
+  cache mount empty, so `make test` compiles everything on every run. The rules
+  in `CLAUDE.md` that `AGENTS.md` lacked are in `AGENTS.md`, and `CLAUDE.md` is
+  deleted.
 - 2026-10-06: `script/test` runs the tests with the race detector, a 30-second
   timeout per package and coverage, as `REPO_POLICIES.md` requires
   (https://git.eeqj.de/sneak/secret/issues/32). When they fail, it reruns them