Brings the scripts-to-rule-them-all scaffold from `next` (script/
entrypoints, Makefile shims, .gitea/workflows/check.yml, vendored
REPO_POLICIES.md) onto `main`, which meanwhile moved to golangci-lint
v2.12.2 with the canonical config.
Only TODO.md conflicted: both sides prepended an entry to Completed
Steps. Kept both in reverse-chronological order and normalized the
`next` entry to the file's `*` bullet style.
.golangci.yml is unchanged from `main`.
Reconciling script/lint, script/fmt-check and script/check with
golangci-lint v2.12.2 is deliberately left to phase 2.
Part of #26
