Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first. The
image takes its version from the VERSION build arg or git describe, and
still stamps the commit and its date from .git. The golangci-lint
v2.14.0 findings are fixed in the code. The rules in CLAUDE.md move into
AGENTS.md. IsDevVersion now counts "unknown", the version script/docker
stamps outside a git checkout.

Model: opus-5-5

TODO.md

@@ -22,6 +22,15 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-06: Re-vendored the canonical files from `sneak/prompts` at
+  `dd4027b` ([issue #213](https://git.eeqj.de/sneak/vaultik/issues/213)).
+  Linting and testing are now the `lint` and `test` phases of the
+  `Dockerfile`, and the build stage depends on both. `Dockerfile.lint`,
+  `CHECK_EPOCH` and the tests that checked them are gone; every
+  `docker build` in `script/` passes `--no-cache` instead. golangci-lint
+  is v2.14.0, with its new findings fixed in the code, and the rules in
+  `CLAUDE.md` now live in `AGENTS.md`.
+
 - 2026-09-22: Routed the last direct-to-stdout command output through
   `internal/ui`
   ([issue #149](https://git.eeqj.de/sneak/vaultik/issues/149)). The