Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first, which
now fetches apt package lists so a fresh CI runner can install Go. The
image takes its version from the VERSION build arg or git describe, and
still stamps the commit and its date from .git. The golangci-lint
v2.14.0 findings are fixed in the code. The rules in CLAUDE.md move into
AGENTS.md. IsDevVersion now counts "unknown", the version script/docker
stamps outside a git checkout.

Model: opus-5-5

AGENTS.md

@@ -108,6 +108,24 @@ Version: 2025-06-08
     code that touches the affected tables) directly. After 1.0, each schema
     change is a new numbered file in that directory and a released file is
     never edited; an existing local database is then migrated when vaultik
-    is updated. See
+    is updated. Before 1.0, a local database left on an older schema is
+    deleted and re-created by a full backup. See
     [`docs/DATAMODEL.md`](docs/DATAMODEL.md#schema-migrations).
 
+14. Never use `git add -A`.  Stage only the files you intentionally
+    changed.
+
+15. Commit messages carry no attribution or advertising trailers for the
+    tool that helped write the code, or for its vendor: the owner is the
+    sole author of code written with a tool.
+
+16. Run the whole test suite with `make test` every time, and read its full
+    output.  Never run `go test`, a single test or a single package, and
+    never grep the output.
+
+17. Do not stop working on a task until the definition of done given in the
+    initial instruction is met: all of the work, not part or most of it.
+
+18. For estimates: backing up over 2.5Gbit/s ethernet to an S3 server
+    backed by 2000MB/sec SSD takes about 4 seconds per gigabyte.
+