Re-vendor the canonical files from sneak/prompts at c55a0cb (closes #95)

Every vendored file, REPO_POLICIES.md and every model script is the
copy at sneak/prompts c55a0cb, with this repository's own entries kept
after the canonical content. Lint and test are phases of the Dockerfile
that write no image, built uncached. make test runs the suite under the
race detector as nobody, because root reads the files the tests make
unreadable. Dockerfile.lint, script/verify-lint-image-pin and
make test-race are gone. Prettier runs on the host, from the node and
yarn that script/bootstrap installs. golangci-lint v2.14.0 raises no
findings. .claude/settings.json is deleted.

Deviation: the set comes from c55a0cb on next rather than dd4027b, as
the instructions on sneak/prompts#78 allow.

Model: opus-5-5

script/test

@@ -1,17 +1,19 @@
 #!/bin/sh
-# script/test: run the test suite. Reruns verbosely on failure so CI
-# logs show which test failed.
+# script/test: run the test suite. Testing is a phase of the Dockerfile
+# and this builds that phase alone, on the same terms as script/lint:
+# --target because a phase that is not the last stage is built only when
+# named, and --no-cache because a cached test layer is a test that did
+# not run. --output type=cacheonly writes no image, since nothing uses one.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -timeout 30s -cover ./... || {
-        echo "--- Rerunning with -v for details ---"
-        go test -timeout 30s -v ./...
-        exit 1
-    }
+    docker build --no-cache \
+        --target test \
+        --output type=cacheonly .
 }
 
 main "$@"