Vendor pinned prettier/format toolchain from prompts scaffold (closes #203)

Replace the unpinned `npx prettier --tab-width 4` in `script/fmt` with the
canonical toolchain vendored from `sneak/prompts`: `.prettierrc` (tabWidth 4,
proseWrap always), pinned `package.json` + `yarn.lock` (prettier 3.8.1), and a
`.prettierignore` that unions the scaffold entries with the repo's `*.min.js`
line. `script/bootstrap` now installs a pinned node/yarn via a hash-verified
nvm release archive (never curl-pipe-sh), so prettier stops being an unpinned
host tool. `script/fmt` runs the pinned prettier via `.prettierrc` over
`static/js/*.js` and `**/*.md`, keeping gofmt/goimports. All existing markdown
is reflowed to house style; `static/js/alpine.min.js` stays byte-identical.

Model: opus-4-8

script/fmt

@@ -4,11 +4,34 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# script/bootstrap installs node and yarn under nvm and leaves neither
+# on the PATH of the shell that called it, so resolve the pinned
+# toolchain here the way bootstrap's own install step does. nvm is a
+# bash script, hence the subshell.
+run_yarn() {
+    if command -v yarn >/dev/null 2>&1; then
+        yarn "$@"
+        return
+    fi
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
+
 main() {
     cd "$ROOT"
     gofmt -s -w .
     goimports -w .
-    npx prettier --write --tab-width 4 static/js/*.js
+    # Pinned prettier reads settings from .prettierrc (tabWidth 4,
+    # proseWrap always); .prettierignore keeps alpine.min.js untouched.
+    # Globs are quoted so prettier expands them, not the shell.
+    run_yarn run prettier --write 'static/js/*.js' '**/*.md'
 }
 
 main "$@"