Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first. A
host without Go gets the go.mod version from script/install-go in
.tool/go, which bootstrap, the Makefile, fmt, fmt-check, precommit and
release add to PATH; fmt-check skips .tool. The image takes its version
from the VERSION build arg or git describe, dev without .git. This
repo's own entries follow the canonical content in .gitignore and
.editorconfig. The golangci-lint v2.14.0 findings are fixed. The rules
in CLAUDE.md move into AGENTS.md. IsDevVersion counts "unknown".

Model: opus-5-5

Makefile

@@ -1,5 +1,8 @@
 .PHONY: all bootstrap setup check test lint lint-fix fmt fmt-check build clean deps test-coverage local install release release-snapshot docker hooks
 
+# Where script/bootstrap installs Go when the host has none.
+export PATH := $(PATH):$(CURDIR)/.tool/go/bin
+
 # Version number, derived from git by script/version (`git describe
 # --tags --always --dirty`). This used to be a hardcoded
 # constant, which meant every local build claimed to be a release that
@@ -40,9 +43,10 @@ setup:
 check:
 	@script/check
 
-# Run tests only. This runs the ENTIRE suite -- there is no separate
-# integration target and no build-tagged subset held back. In
-# particular internal/vaultik/integration_test.go, which does full
+# Run tests only, by building the test phase of the Dockerfile. This
+# runs the ENTIRE suite -- there is no separate integration target and
+# no build-tagged subset held back. In particular
+# internal/vaultik/integration_test.go, which does full
 # chunk -> pack -> encrypt -> upload -> restore round-trips, runs here.
 # A `test-integration` target used to exist and was removed: no file in
 # the repo carried a build tag, so `-tags=integration` selected nothing
@@ -87,17 +91,17 @@ clean:
 	go clean
 
 # Install dependencies. The linter is deliberately not installed here:
-# script/lint lints by building Dockerfile.lint, whose FROM line is the
-# single source of truth for the linter version. A second, separately
-# pinned copy on PATH could drift from it and make a local `make lint`
-# disagree with CI.
+# script/lint lints by building the lint phase of the Dockerfile, whose
+# FROM line is the single source of truth for the linter version. A
+# second, separately pinned copy on PATH could drift from it and make a
+# local `make lint` disagree with CI.
 deps:
 	go mod download
 
-# Run tests with coverage. -count=1 for the same reason script/test
-# uses it: without it an unchanged package is served from Go's test
-# result cache, and a coverage profile assembled from cached results
-# describes a run that did not happen.
+# Run tests with coverage, on the host. -count=1 because without it an
+# unchanged package is served from Go's test result cache, and a
+# coverage profile assembled from cached results describes a run that
+# did not happen.
 test-coverage:
 	go test -v -count=1 -coverprofile=coverage.out ./...
 	go tool cover -html=coverage.out -o coverage.html