Re-vendor the canonical files from sneak/prompts at dd4027b (closes #95)

The shared files are the copies at sneak/prompts commit dd4027b, with this
repository's own entries kept after them. script/lint, script/test and
REPO_POLICIES.md come from its next at c55a0cb, so the lint and test
builds write no image. golangci-lint is v2.14.0 and raises no findings.
Lint and test are phases of the Dockerfile; the tests run under the race
detector as nobody, so Dockerfile.lint, script/verify-lint-image-pin and
make test-race are gone. Every docker build in script/ passes --no-cache.
Formatting runs on the host: script/bootstrap installs the pinned node and
yarn, and the prettier and markdown stages are gone. .claude/settings.json
is deleted.

Deviation: the workflow keeps fetch-depth: 0.
Deviation: .gitignore keeps the scan database patterns.
Over the cap: make test takes 82 to 100 seconds on this host.

Model: opus-5-5

script/lint

@@ -1,28 +1,23 @@
 #!/bin/sh
-# script/lint: run the linter. golangci-lint is never installed on a
-# host: this builds Dockerfile.lint, which copies the repo into the
-# digest-pinned golangci-lint image and lints as a build step, so a
-# successful build is a clean lint. A cold cache needs the network to
-# pull the image and for `go mod download`; once warm this runs offline
-# until go.mod or go.sum changes.
+# script/lint: run the linter. Linting is a phase of the Dockerfile and
+# this builds that phase alone; the linter is never installed or run on
+# a developer host, where a shared result cache and a host-global lock
+# make its answer untrustworthy.
 #
-# Without a fresh CHECK_EPOCH docker serves the gate layers from cache
-# on an unchanged tree and this exits 0 having run no linter. The PID is
-# in the value because two lint runs land inside the same second easily.
-#
-# The image is never used, so --output=type=cacheonly writes none;
-# without it every run leaves an untagged image behind.
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. --no-cache because a cached lint layer is a lint
+# that did not run. --output type=cacheonly writes no image, since
+# nothing uses one.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build \
-        --build-arg CHECK_EPOCH="$(date +%s)-$$" \
-        --output=type=cacheonly \
-        -f Dockerfile.lint \
-        .
+    docker build --no-cache \
+        --target lint \
+        --output type=cacheonly .
 }
 
 main "$@"