Re-vendor the standard files from sneak/prompts dd4027b (closes #33)

REPO_POLICIES.md, .golangci.yml, the CI workflow and the scripts the
policy keeps identical across repositories are copies of the files at
that commit. .gitignore, .editorconfig and the new .dockerignore are the
canonical files followed by this repository's own entries. The lint
stage moves to the golangci-lint image the policy pins, in the same
commit as .golangci.yml. The format check leaves the lint stage and runs
on the host from script/check, which script/cibuild now runs after
script/bootstrap. The last Dockerfile stage runs script/bootstrap, which
installs goimports with go install at a pinned commit; script/fmt runs
that goimports.

Model: opus-5-5

README.md

@@ -141,9 +141,10 @@ development workflow, and the Makefile targets are thin shims that call them.
 The scripts are POSIX sh (not bash) so they run in minimal containers such as
 alpine. We provide:
 
-- `script/bootstrap` — install all dependencies (go if missing, then
-  `go mod download`); golangci-lint is not installed, since it runs only in
-  Docker
+- `script/bootstrap` — install all dependencies (go if missing, goimports with
+  `go install` at a pinned commit unless the installed one already reports the
+  pinned version, then `go mod download`); golangci-lint is not installed,
+  since it runs only in Docker
 - `script/setup` — set up the repo for development after a fresh clone: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (our own extension); used by
@@ -152,9 +153,10 @@ alpine. We provide:
   building only the `test` stage of the `Dockerfile`, without the build cache,
   so every run tests; the image is tagged `simplelog-test`
 - `script/lint` — run golangci-lint in Docker by building only the `lint`
-  stage of the `Dockerfile` (which also runs the format check), without the
-  build cache, so every run lints; the image is tagged `simplelog-lint`
-- `script/fmt` — format all files with goimports (writes)
+  stage of the `Dockerfile`, without the build cache, so every run lints; the
+  image is tagged `simplelog-lint`
+- `script/fmt` — format all files (writes) with the goimports that
+  `script/bootstrap` installs
 - `script/fmt-check` — check formatting (read-only); fails if `gofmt -l`
   reports files
 - `script/check` — run all checks: `test`, `lint`, `fmt-check` (our own
@@ -163,9 +165,8 @@ alpine. We provide:
   via `script/projectname` (byte-identical across repos); it also passes the
   output of `git describe` as the `VERSION` build argument, which is ignored
   because this `Dockerfile` does not declare it
-- `script/cibuild` — cd to the repo root and build the Docker image without the
-  build cache, tagged via `script/projectname` (what CI runs; the image build
-  runs the checks)
+- `script/cibuild` — what CI runs: `script/bootstrap`, then `script/check`,
+  then the same image build as `script/docker` (byte-identical across repos)
 - `script/precommit` — run by the git pre-commit hook (our own extension);
   runs a `go mod tidy` guard, then `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own