Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first. A
host without Go gets the go.mod version from script/install-go in
.tool/go, which the Makefile, script/fmt, script/fmt-check and
script/precommit add to PATH; fmt-check reads the Go files git lists.
The image takes its version from the VERSION build arg or git describe,
dev without .git. This repo's own entries follow the canonical content
in .gitignore and .editorconfig. The golangci-lint v2.14.0 findings are
fixed. The rules in CLAUDE.md move into AGENTS.md. IsDevVersion counts
"unknown".

Model: opus-5-5

script/fmt-check

@@ -7,7 +7,27 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    unformatted="$(gofmt -l .)"
+    # Where script/bootstrap installs Go when the host has none.
+    PATH="$PATH:$ROOT/.tool/go/bin"
+    # The Go files git lists, which leaves out the sources of that
+    # toolchain in the ignored .tool/go. git still lists a tracked file
+    # whose deletion is not staged yet, and gofmt fails on a missing file.
+    listed="$(git ls-files --cached --others --exclude-standard '*.go')" || {
+        echo "fmt-check: git ls-files failed; run it in a git checkout" >&2
+        exit 1
+    }
+    files=""
+    for f in $listed; do
+        if [ -e "$f" ]; then
+            files="$files $f"
+        fi
+    done
+    # gofmt with no file arguments reads standard input.
+    if [ -z "$files" ]; then
+        exit 0
+    fi
+    # shellcheck disable=SC2086 # one argument per file name
+    unformatted="$(gofmt -l $files)"
     if [ -n "$unformatted" ]; then
         echo "Files not formatted:" >&2
         echo "$unformatted" >&2