Re-vendor the standard files from sneak/prompts dd4027b (closes #33)

REPO_POLICIES.md, .golangci.yml, the CI workflow and the scripts the
policy keeps identical across repositories are copies of the files at
that commit. .gitignore, .editorconfig and the new .dockerignore are the
canonical files followed by this repository's own entries. The lint
stage moves to the golangci-lint image the policy pins, in the same
commit as .golangci.yml. The format check leaves the lint stage and runs
on the host from script/check, which script/cibuild now runs after
script/bootstrap. The last Dockerfile stage runs script/bootstrap.
script/fmt runs goimports with go run at a pinned commit.

Model: opus-5-5

README.md

@@ -150,9 +150,10 @@ alpine. We provide:
   building only the `test` stage of the `Dockerfile`, without the build cache,
   so every run tests; the image is tagged `simplelog-test`
 - `script/lint` — run golangci-lint in Docker by building only the `lint`
-  stage of the `Dockerfile` (which also runs the format check), without the
-  build cache, so every run lints; the image is tagged `simplelog-lint`
-- `script/fmt` — format all files with goimports (writes)
+  stage of the `Dockerfile`, without the build cache, so every run lints; the
+  image is tagged `simplelog-lint`
+- `script/fmt` — format all files with goimports (writes); goimports runs
+  with `go run` at a pinned commit, so nothing needs to install it
 - `script/fmt-check` — check formatting (read-only); fails if `gofmt -l`
   reports files
 - `script/check` — run all checks: `test`, `lint`, `fmt-check` (our own
@@ -161,9 +162,8 @@ alpine. We provide:
   via `script/projectname` (byte-identical across repos); it also passes the
   output of `git describe` as the `VERSION` build argument, which is ignored
   because this `Dockerfile` does not declare it
-- `script/cibuild` — cd to the repo root and build the Docker image without the
-  build cache, tagged via `script/projectname` (what CI runs; the image build
-  runs the checks)
+- `script/cibuild` — what CI runs: `script/bootstrap`, then `script/check`,
+  then the same image build as `script/docker` (byte-identical across repos)
 - `script/precommit` — run by the git pre-commit hook (our own extension);
   runs a `go mod tidy` guard, then `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own