Re-vendor the canonical files from sneak/prompts at c55a0cb (closes #95)

Every vendored file, REPO_POLICIES.md and every model script is the
copy at sneak/prompts c55a0cb, with this repository's own entries kept
after the canonical content. Lint and test are phases of the Dockerfile
that write no image, built uncached. make test runs the suite under the
race detector as nobody, because root reads the files the tests make
unreadable. Dockerfile.lint, script/verify-lint-image-pin and
make test-race are gone. Prettier runs on the host, from the node and
yarn that script/bootstrap installs. golangci-lint v2.14.0 raises no
findings. .claude/settings.json is deleted.

Deviation: the set comes from c55a0cb on next rather than dd4027b, as
the instructions on sneak/prompts#78 allow.

Model: opus-5-5

script/lint

@@ -1,28 +1,23 @@
 #!/bin/sh
-# script/lint: run the linter. golangci-lint is never installed on a
-# host: this builds Dockerfile.lint, which copies the repo into the
-# digest-pinned golangci-lint image and lints as a build step, so a
-# successful build is a clean lint. A cold cache needs the network to
-# pull the image and for `go mod download`; once warm this runs offline
-# until go.mod or go.sum changes.
+# script/lint: run the linter. Linting is a phase of the Dockerfile and
+# this builds that phase alone; the linter is never installed or run on
+# a developer host, where a shared result cache and a host-global lock
+# make its answer untrustworthy.
 #
-# Without a fresh CHECK_EPOCH docker serves the gate layers from cache
-# on an unchanged tree and this exits 0 having run no linter. The PID is
-# in the value because two lint runs land inside the same second easily.
-#
-# The image is never used, so --output=type=cacheonly writes none;
-# without it every run leaves an untagged image behind.
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. --no-cache because a cached lint layer is a lint
+# that did not run. --output type=cacheonly writes no image, since
+# nothing uses one.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build \
-        --build-arg CHECK_EPOCH="$(date +%s)-$$" \
-        --output=type=cacheonly \
-        -f Dockerfile.lint \
-        .
+    docker build --no-cache \
+        --target lint \
+        --output type=cacheonly .
 }
 
 main "$@"