Re-vendor the standard files from sneak/prompts dd4027b (closes #33)

REPO_POLICIES.md, .golangci.yml, the CI workflow and the scripts the
policy keeps identical across repositories are copies of the files at
that commit. .gitignore, .editorconfig and the new .dockerignore are the
canonical files followed by this repository's own entries. The lint
stage moves to the golangci-lint image the policy pins, in the same
commit as .golangci.yml. The format check leaves the lint stage and runs
on the host from script/check, which script/cibuild now runs after
script/bootstrap. The last Dockerfile stage runs script/bootstrap, which
installs goimports with go install at a pinned commit; script/fmt runs
that goimports.

Model: opus-5-5

script/bootstrap

@@ -7,6 +7,11 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# goimports from golang.org/x/tools v0.30.0, 2025-02-10: the last release
+# that Go 1.22, the Go of go.mod and the Dockerfile, can build.
+GOIMPORTS_COMMIT="09747cdf594a7924dcecb506312be3bd6e437962"
+GOIMPORTS_VERSION="v0.30.0"
+
 PKGMGR=""
 SUDO=""
 
@@ -47,6 +52,35 @@ missing() {
     ! command -v "$1" >/dev/null 2>&1
 }
 
+# Print the golang.org/x/tools version that the goimports on PATH was
+# built from, or nothing. goimports has no --version flag; `go version -m`
+# prints the module versions Go records in every binary it builds.
+goimports_version() {
+    bin="$(command -v goimports)" || return 0
+    go version -m "$bin" 2>/dev/null |
+        awk '$1 == "mod" && $2 == "golang.org/x/tools" { print $3 }'
+}
+
+# Install goimports at the pinned commit unless the one on PATH already
+# reports the pinned version. go install writes to GOBIN, or to the bin
+# directory of GOPATH when GOBIN is unset, which need not be on the
+# caller's PATH; script/fmt puts that directory first on PATH the same
+# way, so the check here sees the goimports that script/fmt runs.
+ensure_goimports() {
+    gobin="$(go env GOBIN)"
+    PATH="${gobin:-$(go env GOPATH)/bin}:$PATH"
+    if [ "$(goimports_version)" != "$GOIMPORTS_VERSION" ]; then
+        go install "golang.org/x/tools/cmd/goimports@$GOIMPORTS_COMMIT"
+        hash -r
+        if [ "$(goimports_version)" != "$GOIMPORTS_VERSION" ]; then
+            echo "bootstrap: goimports on PATH is not $GOIMPORTS_VERSION" \
+                "after installing it: $(command -v goimports || echo none)" >&2
+            exit 1
+        fi
+    fi
+    echo "goimports $GOIMPORTS_VERSION at $(command -v goimports)"
+}
+
 main() {
     cd "$ROOT"
 
@@ -55,6 +89,7 @@ main() {
 
     if missing go; then pkg_install go golang go go; fi
     # golangci-lint is not installed: it runs only in docker (script/lint).
+    ensure_goimports
 
     go mod download