Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first. The
image takes its version from the VERSION build arg or git describe, and
still stamps the commit and its date from .git. The golangci-lint
v2.14.0 findings are fixed in the code. The rules in CLAUDE.md move into
AGENTS.md. IsDevVersion now counts "unknown", the version script/docker
stamps outside a git checkout.

Model: opus-5-5

Dockerfile

@@ -1,92 +1,68 @@
-# This file has no lint stage, deliberately.
-#
-# Linting lives in Dockerfile.lint, built by script/lint, and
-# script/cibuild builds both. A lint stage here would have to either
-# shell out to `make lint` -- which is now `docker build`, so
-# docker-in-docker inside a BuildKit step with no daemon -- or call
-# golangci-lint directly, which would mean a second, independently
-# bumpable digest pin for the linter alongside the one in
-# Dockerfile.lint. Two pins for one tool is the drift that
-# https://git.eeqj.de/sneak/vaultik/issues/78 was filed over. See
-# https://git.eeqj.de/sneak/vaultik/issues/113 for the ruling.
-#
-# Consequence, stated rather than left to be discovered: script/docker
-# builds this file only and therefore does not lint. `make fmt-check`
-# and `make test` still run here, so what a green build of this file
-# means is "formatted, tested, and it compiles" -- the lint verdict
-# comes from script/lint or script/cibuild.
-
-# Build stage
-# golang:1.26.1-alpine, 2026-03-17
-FROM golang:1.26.1-alpine@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039 AS builder
-
-# Build tooling: make, plus a C toolchain because `go test -race` needs cgo,
-# and git, which derives the version below. The sqlite driver is pure Go
-# (modernc.org/sqlite), so no sqlite library or CLI is required.
-RUN apk add --no-cache make build-base git
-
+# Lint phase. The linter is invoked directly rather than through `make
+# lint` or `script/lint`, which are themselves a docker build and would
+# recurse into a daemon that does not exist in a build step.
+# golangci/golangci-lint:v2.14.0, 2026-10-05
+FROM golangci/golangci-lint:v2.14.0@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 WORKDIR /src
-
-# Copy go mod files first for better layer caching
 COPY go.mod go.sum ./
 RUN go mod download
+COPY . .
+# `golangci-lint run` silently ignores an unknown top-level key in
+# .golangci.yml, such as a misspelt `linters:`; `config verify` fails on it.
+RUN golangci-lint config verify --config .golangci.yml
+RUN golangci-lint run --config .golangci.yml ./...
 
-# Copy source code
+# Test phase. -race needs cgo and so a C compiler, which the Debian Go
+# image ships and the alpine one does not.
+# golang:1.26.1 (Debian trixie), 2026-10-05
+FROM golang:1.26.1@sha256:cd78d88e00afadbedd272f977d375a6247455f3a4b1178f8ae8bbcb201743a8a AS test
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN go test -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -timeout 90s -race -v ./...; exit 1; }
+
+# Build stage. Nothing is wanted from either phase above; the copies
+# are what make BuildKit build them first, so this stage cannot run
+# unless lint and test passed.
+# golang:1.26.1-alpine, 2026-03-17
+FROM golang:1.26.1-alpine@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039 AS builder
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null
+RUN apk add --no-cache git
+# A tar-stream context keeps the sender's file owners, which git refuses.
+RUN git config --system --add safe.directory /src
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
 COPY . .
 
-# Run the format check and the tests.
-#
-# CHECK_EPOCH must stay immediately above these RUNs. These layers are
-# keyed on its value, so they are cache-eligible only for a value
-# already built against this same tree. script/cibuild and script/docker
-# each pass a fresh value on every invocation, which is what makes their
-# green mean the checks really executed.
-#
-# The value is expanded into each check command rather than left to a
-# bare declaration, so the cache miss does not depend on BuildKit's
-# unreferenced-ARG handling staying as it is. It also puts the epoch in
-# the build log, where a reader can see the layer was keyed fresh.
-#
-# A build that passes no CHECK_EPOCH, such as a plain `docker build .`,
-# keys these layers on the empty string, so rebuilding an unchanged
-# checkout replays them from cache and runs nothing. Only the scripts'
-# builds mean the checks executed.
-#
-# Everything above this line (apk, go.mod, `go mod download`) is
-# deliberately outside the busted range and keeps caching.
-ARG CHECK_EPOCH
-RUN echo "check epoch: ${CHECK_EPOCH}" && make fmt-check
-RUN echo "check epoch: ${CHECK_EPOCH}" && make test
-
-# Version, commit and build date: the build args when given (script/docker
-# and script/cibuild pass the ones they compute on the host), otherwise
-# derived from the .git in the build context. The version is then `git
-# describe --tags --always`: the tag on a tagged commit, tag-N-gHASH after
-# one, the short commit when no tag is reachable. A context that carries
-# .git and still yields no version fails the build; one without .git, as
-# from a source tarball, stamps "dev" and an "unknown" commit and date.
-#
-# These ARGs sit here, after the checks, rather than at the top of the
-# stage: every commit changes their values, and a value change
-# invalidates all layers below the ARG. Declared up top they would bust
-# `go mod download`; here they only rekey this build layer, which the
-# COPY of the sources above already rebuilds on any change anyway.
+# The VERSION build arg when one is given, otherwise
+# `git describe --tags --always` on the .git in the build context. With
+# .git present, a version that is still empty, dev or unknown fails the
+# build: git is missing or could not read the checkout. The commit and
+# its date always come from that .git, and are "unknown" without one.
 ARG VERSION
-ARG COMMIT
-ARG COMMIT_DATE
-
-# Build (pure Go, no CGO required since we use modernc.org/sqlite)
-RUN version="${VERSION:-$(git describe --tags --always || echo dev)}"; \
-    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
-        [ "$version" = unknown ]; }; then \
-        echo "the build context carries .git but yields no version" >&2; \
-        exit 1; \
+RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ]; then \
+        case "$VERSION" in ""|dev|unknown) \
+            echo "version is '$VERSION' although .git is present" >&2; \
+            exit 1 ;; \
+        esac; \
     fi; \
-    commit="${COMMIT:-$(git rev-parse HEAD || echo unknown)}"; \
-    commit_date="${COMMIT_DATE:-$(git show -s --format=%cs HEAD || echo unknown)}"; \
-    CGO_ENABLED=0 go build -ldflags "-X 'sneak.berlin/go/vaultik/internal/globals.Version=${version}' -X 'sneak.berlin/go/vaultik/internal/globals.Commit=${commit}' -X 'sneak.berlin/go/vaultik/internal/globals.CommitDate=${commit_date}'" -o /vaultik ./cmd/vaultik
+    commit="$(git rev-parse HEAD || echo unknown)"; \
+    commit_date="$(git show -s --format=%cs HEAD || echo unknown)"; \
+    globals=sneak.berlin/go/vaultik/internal/globals; \
+    CGO_ENABLED=0 go build -trimpath \
+        -ldflags="-s -w -X ${globals}.Version=${VERSION} \
+            -X ${globals}.Commit=${commit} \
+            -X ${globals}.CommitDate=${commit_date}" \
+        -o /vaultik ./cmd/vaultik
 
-# Runtime stage
+# Runtime stage, and the last one: a plain `docker build .` builds this
+# stage's chain and nothing else.
 # alpine:3.21, 2026-02-25
 FROM alpine:3.21@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709