Merge branch 'next' into merge/next-to-main-1.1.0 for 1.1.0

Brings the scripts-to-rule-them-all scaffold from `next` (script/
entrypoints, Makefile shims, .gitea/workflows/check.yml, vendored
REPO_POLICIES.md) onto `main`, which meanwhile moved to golangci-lint
v2.12.2 with the canonical config.

Only TODO.md conflicted: both sides prepended an entry to Completed
Steps. Kept both in reverse-chronological order and normalized the
`next` entry to the file's `*` bullet style.

.golangci.yml is unchanged from `main`.

Reconciling script/lint, script/fmt-check and script/check with
golangci-lint v2.12.2 is deliberately left to phase 2.

Part of #26

TODO.md

@@ -28,6 +28,8 @@ files it depends on: .golangci.yml, REPO_POLICIES.md, .editorconfig,
     `Dockerfile` lint stage to golangci-lint v2.12.2 (tag+digest), and
     fixed all findings the v1→v2 jump surfaced without changing any
     exported signatures or behavior
+* 2026-07-07: adopted scripts-to-rule-them-all: `script/` entrypoints,
+    Makefile shims, README Entrypoints section
 * 2026-02-08: fixed JSONHandler deadlock from recursive log.Println,
     with regression test; tagged 1.0.1
 * 2024-06-14: 1.0 prep: lint and fmt enforced in Docker build, call