Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first, which
now fetches apt package lists so a fresh CI runner can install Go. The
image takes its version from the VERSION build arg or git describe, and
still stamps the commit and its date from .git. The golangci-lint
v2.14.0 findings are fixed in the code. The rules in CLAUDE.md move into
AGENTS.md. IsDevVersion now counts "unknown", the version script/docker
stamps outside a git checkout.

Model: opus-5-5

TODO.md

@@ -22,6 +22,15 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-06: Re-vendored the canonical files from `sneak/prompts` at
+  `dd4027b` ([issue #213](https://git.eeqj.de/sneak/vaultik/issues/213)).
+  Linting and testing are now the `lint` and `test` phases of the
+  `Dockerfile`, and the build stage depends on both. `Dockerfile.lint`,
+  `CHECK_EPOCH` and the tests that checked them are gone; every
+  `docker build` in `script/` passes `--no-cache` instead. golangci-lint
+  is v2.14.0, with its new findings fixed in the code, and the rules in
+  `CLAUDE.md` now live in `AGENTS.md`.
+
 - 2026-09-22: Routed the last direct-to-stdout command output through
   `internal/ui`
   ([issue #149](https://git.eeqj.de/sneak/vaultik/issues/149)). The