Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first. A
host without Go gets the go.mod version from script/install-go in
.tool/go, which the Makefile, script/fmt, script/fmt-check and
script/precommit add to PATH; fmt-check reads the Go files git lists.
The image takes its version from the VERSION build arg or git describe,
dev without .git. This repo's own entries follow the canonical content
in .gitignore and .editorconfig. The golangci-lint v2.14.0 findings are
fixed. The rules in CLAUDE.md move into AGENTS.md. IsDevVersion counts
"unknown".

Model: opus-5-5

script/install-go

@@ -4,12 +4,13 @@
 # own extension to scripts-to-rule-them-all. Idempotent: exits at once
 # when the pinned toolchain is already installed.
 #
-# Only .gitea/workflows/release.yml calls this. goreleaser is not a
+# .gitea/workflows/release.yml calls this, and so does script/bootstrap
+# when the host has no Go, as on the check runner. goreleaser is not a
 # compiler: it shells out to `go` for the `before:` hook and for every
 # one of the four cross-compiles, so the release runner needs a Go
-# toolchain on PATH. check.yml never does -- it builds inside the
-# digest-pinned Dockerfile images -- so this is the release path's only
-# host Go, and per REPO_POLICIES.md it must be pinned by hash.
+# toolchain on PATH. The check runner compiles nothing on the host; it
+# uses this Go only for bootstrap's `go mod download` and for gofmt in
+# script/fmt-check. Per REPO_POLICIES.md a host Go is pinned by hash.
 # actions/setup-go exposes no checksum input, so Go is installed the way
 # script/install-goreleaser installs goreleaser: download the exact
 # archive from go.dev and refuse it unless its sha256 matches the value
@@ -18,11 +19,11 @@
 # The version is go.mod's `go` directive, the single source of truth for
 # the toolchain. GO_VERSION below MUST equal it, and this script fails
 # when they disagree -- so bumping Go is one reviewed change touching
-# go.mod, the checksum here, and the Dockerfile golang digest together.
+# go.mod, the checksums here, and the Dockerfile's two golang digests
+# together.
 #
-# Linux only, because that is what the release runner is. A darwin dev
-# building a snapshot uses their own Go; supporting an OS means adding
-# its checksums.
+# Linux and macOS, each on amd64 and arm64: the four archives whose
+# checksums are committed below.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -33,6 +34,8 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 GO_VERSION="1.26.1"
 SHA256_LINUX_AMD64="031f088e5d955bab8657ede27ad4e3bc5b7c1ba281f05f245bcc304f327c987a"
 SHA256_LINUX_ARM64="a290581cfe4fe28ddd737dde3095f3dbeb7f2e4065cab4eae44dfc53b760c2f7"
+SHA256_DARWIN_AMD64="65773dab2f8cc4cd23d93ba6d0a805de150ca0b78378879292be0b903b8cdd08"
+SHA256_DARWIN_ARM64="353df43a7811ce284c8938b5f3c7df40b7bfb6f56cb165b150bc40b5e2dd541f"
 
 GOROOT_DIR="$ROOT/.tool/go"
 GOCMD="$GOROOT_DIR/bin/go"
@@ -101,26 +104,28 @@ main() {
     arch="$(uname -m)"
     case "$os" in
         Linux) os="linux" ;;
+        Darwin) os="darwin" ;;
         *)
-            echo "install-go: unsupported OS $os (release runner is Linux)" >&2
+            echo "install-go: unsupported OS $os" >&2
             exit 1
             ;;
     esac
     case "$arch" in
-        x86_64 | amd64)
-            arch="amd64"
-            sum="$SHA256_LINUX_AMD64"
-            ;;
-        arm64 | aarch64)
-            arch="arm64"
-            sum="$SHA256_LINUX_ARM64"
-            ;;
+        x86_64 | amd64) arch="amd64" ;;
+        arm64 | aarch64) arch="arm64" ;;
         *)
-            echo "install-go: no pinned checksum for architecture $arch" >&2
+            echo "install-go: unsupported architecture $arch" >&2
             exit 1
             ;;
     esac
 
+    case "${os}-${arch}" in
+        linux-amd64) sum="$SHA256_LINUX_AMD64" ;;
+        linux-arm64) sum="$SHA256_LINUX_ARM64" ;;
+        darwin-amd64) sum="$SHA256_DARWIN_AMD64" ;;
+        darwin-arm64) sum="$SHA256_DARWIN_ARM64" ;;
+    esac
+
     archive="go${GO_VERSION}.${os}-${arch}.tar.gz"
     url="https://go.dev/dl/${archive}"