Re-vendor the canonical files from sneak/prompts at dd4027b (closes #65)

The vendored files are fetched from sneak/prompts commit dd4027b, with
this repository's /bin carried forward in .dockerignore; the
test-support deny list has no entries of its own. The lint phase moves
to golangci-lint v2.14.0. The build stage now takes the version from
git describe on the .git the build context carries, unless VERSION is
passed, and fails when .git is present but no version comes out. The
test phase drops -count=1, which the policy says it does not need, and
keeps its tmpfs build cache. One test calls Header.Get with X-Real-IP,
as canonicalheader asks.

Deviation: the Go lines of .gitignore and .editorconfig are dropped;
they are not exempt from byte-identity.

Model: opus-5-5

Dockerfile

@@ -2,8 +2,8 @@
 # lint` or `script/lint`, which are themselves a docker build and would
 # recurse into a daemon that does not exist in a build step.
 #
-# golangci/golangci-lint v2.12.2 (built with go1.26.2), 2026-05-06
-FROM golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+# golangci/golangci-lint v2.14.0 (built with go1.27.0), 2026-09-24
+FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 
 WORKDIR /src
 
@@ -32,9 +32,9 @@ COPY . .
 # Go's build cache is kept on a tmpfs, out of the image: nothing uses it
 # after this step, and writing it into the image takes seconds.
 RUN --mount=type=tmpfs,target=/root/.cache/go-build \
-    go test -count=1 -timeout 90s -race -cover ./... || \
+    go test -timeout 90s -race -cover ./... || \
     { echo "--- Rerunning with -v for details ---"; \
-      go test -count=1 -timeout 90s -race -v ./...; exit 1; }
+      go test -timeout 90s -race -v ./...; exit 1; }
 
 # Build stage. Nothing is wanted from the two phases above; the copies
 # are what make BuildKit build them first, so the image, which needs this
@@ -46,6 +46,10 @@ FROM golang@sha256:3b77fc618ec235a1ab412de7737f120dd507c57e8d87de4cbb7994fb94275
 COPY --from=lint /src/go.sum /dev/null
 COPY --from=test /src/go.sum /dev/null
 
+# This image has git. A tar-stream context keeps the sender's file
+# owners, which git refuses.
+RUN git config --system --add safe.directory /src
+
 WORKDIR /src
 
 COPY go.mod go.sum ./
@@ -53,12 +57,21 @@ RUN go mod download
 
 COPY . .
 
-# The version is computed on the host and passed in, because
-# .dockerignore excludes .git.
-ARG VERSION=dev
-RUN CGO_ENABLED=0 go build -trimpath \
-    -ldflags="-s -w -X main.Version=${VERSION}" \
-    -o /usr/local/bin/smallwebwaf ./cmd/smallwebwaf
+# The VERSION build arg when one is given, otherwise
+# `git describe --tags --always` on the .git in the build context. With
+# .git present, a version that is still empty, dev or unknown fails the
+# build: git is missing or could not read the checkout.
+ARG VERSION
+RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ]; then \
+        case "$VERSION" in ""|dev|unknown) \
+            echo "version is '$VERSION' although .git is present" >&2; \
+            exit 1 ;; \
+        esac; \
+    fi; \
+    CGO_ENABLED=0 go build -trimpath \
+        -ldflags="-s -w -X main.Version=${VERSION}" \
+        -o /usr/local/bin/smallwebwaf ./cmd/smallwebwaf
 
 # runsvinit, the image's entrypoint, built at the last commit of its
 # archived repository. It has no go.mod, and `go build` of its directory