Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first. A
host without Go gets the go.mod version from script/install-go in
.tool/go, which bootstrap, the Makefile, fmt, fmt-check, precommit and
release add to PATH; fmt-check skips .tool. The image takes its version
from the VERSION build arg or git describe, dev without .git. This
repo's own entries follow the canonical content in .gitignore and
.editorconfig. The golangci-lint v2.14.0 findings are fixed. The rules
in CLAUDE.md move into AGENTS.md. IsDevVersion counts "unknown".

Model: opus-5-5

TODO.md

@@ -22,6 +22,15 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-06: Re-vendored the canonical files from `sneak/prompts` at
+  `dd4027b` ([issue #213](https://git.eeqj.de/sneak/vaultik/issues/213)).
+  Linting and testing are now the `lint` and `test` phases of the
+  `Dockerfile`, and the build stage depends on both. `Dockerfile.lint`,
+  `CHECK_EPOCH` and the tests that checked them are gone; every
+  `docker build` in `script/` passes `--no-cache` instead. golangci-lint
+  is v2.14.0, with its new findings fixed in the code, and the rules in
+  `CLAUDE.md` now live in `AGENTS.md`.
+
 - 2026-10-06: Made the local index actually run in WAL mode with a busy
   timeout ([issue #217](https://git.eeqj.de/sneak/vaultik/issues/217)).
   The connection settings were written in a form the SQLite driver