Re-vendor the canonical files from sneak/prompts at dd4027b (closes #65)

The vendored files are fetched from sneak/prompts commit dd4027b. This
repository's own entries are kept after the canonical content: /bin in
.dockerignore, the Go lines of .gitignore and [*.go] in .editorconfig;
the test-support deny list has no entries of its own. The lint phase
moves to golangci-lint v2.14.0. The build stage now takes the version
from git describe on the .git the build context carries, unless VERSION
is passed, and fails when .git is present but no version comes out. The
test phase drops -count=1, which the policy says it does not need, and
keeps its tmpfs build cache. One test calls Header.Get with X-Real-IP,
as canonicalheader asks.

Model: opus-5-5

.dockerignore

@@ -58,6 +58,9 @@
 # Dependencies: restored inside the image, never copied in.
 **/node_modules
 
+# The binary `make build` writes on the host; the image builds its own.
+/bin
+
 # OS metadata.
 **/.DS_Store
 **/Thumbs.db
@@ -70,6 +73,3 @@
 **/.idea
 **/.vscode
 **/*.sublime-*
-
-# The binary `make build` writes on the host; the image builds its own.
-/bin