Keep Go's build cache in check builds: re-vendor sneak/prompts e3f79c4 (closes #129)

The vendored files are copies from sneak/prompts e3f79c4, with this
repository's own entries kept. The script/ builds pass a new CACHEBUST
value instead of --no-cache, which emptied Go's build cache mount, so
every make test compiled the standard library and every dependency with
-race. Every Dockerfile stage declares ARG CACHEBUST first, so every RUN
step still reruns on an unchanged tree. The steps that compile mount
Go's build cache, and both go test runs keep -count=1. The lint and test
builds write no image. script/bootstrap, script/fmt and script/fmt-check
are the canonical files plus this repository's Go steps.

Model: opus-5-5

TODO.md

@@ -17,11 +17,6 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
-- 2026-10-15: The comment on `commandWait` in `internal/cli/integration_test.go`
-  no longer says `script/test` gives the package 30 seconds
-  (https://git.eeqj.de/sneak/secret/issues/195). `script/test` sets no time
-  limit; the test phase of the `Dockerfile` sets one with `go test -timeout`.
-  The comment now names that place instead of a number.
 - 2026-10-15: The canonical files are re-vendored from `sneak/prompts` commit
   `e3f79c4` (https://git.eeqj.de/sneak/secret/issues/129), so Go's build cache
   survives between check builds and `make test` no longer compiles the standard

internal/cli/integration_test.go

@@ -34,10 +34,9 @@ const (
 	testMnemonic = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
 
 	// commandWait is how long a test lets the secret binary run before it
-	// kills it and fails. It stays well under the time limit the test phase
-	// of the Dockerfile gives the whole package (go test -timeout), so a
-	// command that hangs fails the test with the test's own message instead
-	// of Go's timeout panic.
+	// kills it and fails. It stays well under the 30 seconds script/test
+	// gives the whole package, so a command that hangs fails the test with
+	// the test's own message instead of Go's timeout panic.
 	commandWait = 10 * time.Second
 )