Restore Markdown formatting in fmt/fmt-check and pin prettier (closes #19)

script/fmt and script/fmt-check now run gofmt for Go and prettier for
Markdown; fmt-check reports each independently. prettier is pinned at
3.8.1 by package.json/yarn.lock (integrity hash); .prettierrc and
.prettierignore are the house settings copied from the prompts repo.
script/bootstrap installs node and yarn from the host package manager
and runs `yarn install --frozen-lockfile`.

The Markdown check runs in CI via the Dockerfile build stage, where
bootstrap provides prettier; it is removed from the lint stage because
the golangci-lint image has no node. JS manifests are copied before
bootstrap so the yarn layer caches, and node_modules is dockerignored.

node is an unpinned host runtime like git/make/go: nvm's glibc node does
not run on the musl/Alpine build image, so the canonical nvm route is
not usable here; prettier is the hash-pinned formatter. The wholesale
Markdown reformat follows in the next commit.

Model: opus-4-8

Dockerfile

@@ -27,9 +27,12 @@ ARG CHECK_EPOCH
 # target now runs `docker build -f Dockerfile.lint`, and a docker build
 # cannot run a docker build: routing the gate through make would mean
 # nesting docker inside this image. Same reason `make check` is gone
-# from the build stage below. `make fmt-check` stays as it is — it is a
-# gate, not the aggregate, and it shells out to nothing.
-RUN echo "gate fmt-check, epoch ${CHECK_EPOCH}" && make fmt-check
+# from the build stage below.
+#
+# `make fmt-check` is not run in this stage: it now also runs prettier
+# over Markdown, and this golangci-lint image has no node. The gate runs
+# in the build stage below, where script/bootstrap installs node and
+# prettier.
 
 # The FROM above and the one in Dockerfile.lint pin the same linter
 # twice, and nothing else keeps them in sync; this fails the build when
@@ -77,10 +80,12 @@ COPY --from=lint /src/go.sum /dev/null
 # rather than duplicating the installs inline. Only script/ and the
 # dependency manifests are copied first, nothing else, so this layer
 # stays cached until the scripts or the dependencies change — bootstrap
-# ends in `go mod download`, which is why there is no separate
-# invocation of it here.
+# runs `go mod download` and `yarn install`, which is why there is no
+# separate invocation of either here. The JS manifests (package.json,
+# yarn.lock) are copied too so the yarn install layer caches alongside
+# the Go one.
 COPY script/ script/
-COPY go.mod go.sum ./
+COPY go.mod go.sum package.json yarn.lock ./
 RUN script/bootstrap
 
 COPY . .