Restore Markdown formatting in fmt/fmt-check and pin prettier (closes #19)

script/fmt and script/fmt-check now run gofmt for Go and prettier for
Markdown; fmt-check reports each independently. prettier is pinned at
3.8.1 by package.json/yarn.lock (integrity hash); .prettierrc and
.prettierignore are the house settings copied from the prompts repo.
script/bootstrap installs node and yarn from the host package manager
and runs `yarn install --frozen-lockfile`.

The Markdown check runs in CI via the Dockerfile build stage, where
bootstrap provides prettier; it is removed from the lint stage because
the golangci-lint image has no node. JS manifests are copied before
bootstrap so the yarn layer caches, and node_modules is dockerignored.

node is an unpinned host runtime like git/make/go: nvm's glibc node does
not run on the musl/Alpine build image, so the canonical nvm route is
not usable here; prettier is the hash-pinned formatter. The wholesale
Markdown reformat follows in the next commit.

Model: opus-4-8

README.md

@@ -452,14 +452,18 @@ and may be invoked directly. The provided entrypoints are:
 
 -   `script/bootstrap` — install everything needed to build and
     develop this repository, idempotently, assuming nothing is
-    present. `git`, `make`, and `go` come from the first of nix, apt,
-    brew, or apk found on the host, and are presence-checked only.
-    `golangci-lint` is deliberately **not** installed: it runs from a
-    digest-pinned image via `script/lint` and never from a host
-    install, so there is no host copy to drift from the pin. A missing
-    `docker` is warned about rather than installed or treated as
-    fatal — everything except linting works without it. Ends with
-    `go mod download`.
+    present. `git`, `make`, `go`, and `node` come from the first of nix,
+    apt, brew, or apk found on the host, and are presence-checked only;
+    `node` is an unpinned host runtime like the rest, because nvm's
+    prebuilt node is glibc-linked and does not run on this repo's
+    musl/Alpine build image. The Markdown formatter itself — `prettier` —
+    is pinned by `yarn.lock`'s integrity hash and installed with
+    `yarn install --frozen-lockfile`. `golangci-lint` is deliberately
+    **not** installed: it runs from a digest-pinned image via
+    `script/lint` and never from a host install, so there is no host copy
+    to drift from the pin. A missing `docker` is warned about rather than
+    installed or treated as fatal — everything except linting works
+    without it. Ends with `go mod download` and the `yarn` install.
 -   `script/setup` — make a fresh clone ready for development: runs
     `script/bootstrap`, then `script/install-precommit`.
 -   `script/projectname` — print this project's name (`sfdupes`).
@@ -490,10 +494,15 @@ and may be invoked directly. The provided entrypoints are:
     `go.sum` changes and the download layer goes cold again. Because
     the daemon only ever sees a build context, this works when the
     docker daemon is remote and bind mounts are impossible.
--   `script/fmt` — format the Go sources in place (`gofmt -s -w`).
-    Markdown is not formatted.
--   `script/fmt-check` — the read-only counterpart of `script/fmt`:
-    prints any unformatted file and exits non-zero instead of writing.
+-   `script/fmt` — format in place: `gofmt -s -w` for Go sources and
+    `prettier` for Markdown (`--tab-width 4 --prose-wrap always`, the
+    house settings, also carried in `.prettierrc`). prettier is the
+    pinned devDependency in `package.json`/`yarn.lock`, installed by
+    `script/bootstrap`.
+-   `script/fmt-check` — the read-only counterpart of `script/fmt`: runs
+    both checks, reports each independently so it is clear which failed,
+    and exits non-zero if either found unformatted files instead of
+    writing.
 -   `script/check` — run `script/test`, `script/lint`, and
     `script/fmt-check`, in that order. Modifies nothing. Needs
     `docker`, because `script/lint` does.
@@ -557,8 +566,8 @@ carries the compile recipe:
     `-v` on failure).
 -   `make lint` — run `golangci-lint` with the repo config, in Docker
     (see `script/lint`); requires `docker`.
--   `make fmt` / `make fmt-check` — format Go sources / verify
-    formatting without writing.
+-   `make fmt` / `make fmt-check` — format Go and Markdown sources /
+    verify both without writing.
 -   `make check` — `test`, `lint`, and `fmt-check`; modifies nothing.
     Requires `docker`, via `lint`.
 -   `make docker` — build the Docker image, which runs the gates as