Re-vendor the canonical files from sneak/prompts at dd4027b (closes #95)

The shared files are the copies at sneak/prompts commit dd4027b, with this
repository's own entries kept after them. script/lint, script/test and
REPO_POLICIES.md come from its next at c55a0cb, so the lint and test
builds write no image. golangci-lint is v2.14.0 and raises no findings.
Lint and test are phases of the Dockerfile; the tests run under the race
detector as nobody, so Dockerfile.lint, script/verify-lint-image-pin and
make test-race are gone. Every docker build in script/ passes --no-cache.
Formatting runs on the host: script/bootstrap installs the pinned node and
yarn, and the prettier and markdown stages are gone. .claude/settings.json
is deleted.

Deviation: the workflow keeps fetch-depth: 0.
Deviation: .gitignore keeps the scan database patterns.
Over the cap: make test takes 82 to 100 seconds on this host.

Model: opus-5-5

script/fmt-check

@@ -1,19 +1,35 @@
 #!/bin/sh
-# script/fmt-check: check formatting (read-only). Same scope as
-# script/fmt, but fails instead of writing. gofmt and prettier both run
-# every time and each reports its own failure, so the output says which
-# one failed.
+# script/fmt-check: check formatting (read-only).
 set -eu
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# script/bootstrap installs node and yarn under nvm and leaves neither
+# on the PATH of the shell that called it, so resolve the pinned
+# toolchain here the way bootstrap's own install step does. nvm is a
+# bash script, hence the subshell.
+run_yarn() {
+    if command -v yarn >/dev/null 2>&1; then
+        exec yarn "$@"
+    fi
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt-check: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
 
 main() {
     cd "$ROOT"
     status=0
 
-    # Under set -e a bare assignment would end the script when gofmt
-    # fails (a Go file it cannot parse), and prettier would never run.
+    # gofmt and prettier both run every time, so the output names each
+    # one that fails. Under set -e a bare assignment would end the
+    # script when gofmt fails (a Go file it cannot parse).
     if ! files="$(gofmt -s -l .)"; then
         echo "gofmt: failed; see its errors above" >&2
         status=1
@@ -24,14 +40,9 @@ main() {
         status=1
     fi
 
-    # Same image as script/fmt; see there.
-    image="$("$SCRIPT_DIR/projectname")-prettier"
-    docker build -q --target prettier -t "$image" . >/dev/null
-    if ! docker run --rm -v "$ROOT:/src:ro" "$image" \
-        prettier --check '**/*.md' --tab-width 4 --prose-wrap always; then
-        echo "prettier: Markdown not formatted; run make fmt" >&2
+    # run_yarn ends in exec; the subshell returns here afterwards.
+    (run_yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always) ||
         status=1
-    fi
 
     exit "$status"
 }