files.dat was the pre-database on-disk scan format; nothing has
produced it since the persistent SQLite database landed. Drop the
stale references from Makefile clean, .gitignore and .dockerignore.
make clean still removes the binary, and .gitignore still covers the
actual database artifacts (*.sqlite, *.sqlite-shm, *.sqlite-wal). The
sole remaining files.dat mention is the historical entry in TODO.md.
Model: opus-4-8
Multistage build per policy: a fail-fast lint stage on the pinned
golangci-lint image runs fmt-check and lint, the builder stage reuses
its linter binary (which also forces stage ordering), runs make check,
and builds; the runtime stage is pinned alpine with just the binary.
CI runs docker build . on push with the checkout action pinned by
commit SHA. All image references pinned by sha256 digest with
version/date comments.
sneak