Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first. The
image takes its version from the VERSION build arg or git describe, and
still stamps the commit and its date from .git. The golangci-lint
v2.14.0 findings are fixed in the code. The rules in CLAUDE.md move into
AGENTS.md. IsDevVersion now counts "unknown", the version script/docker
stamps outside a git checkout.

Model: opus-5-5

internal/config/size.go

@@ -16,8 +16,6 @@ var (
 // Size represents a byte size that can be specified in configuration files.
 // It can unmarshal from both numeric values (interpreted as bytes) and
 // human-readable strings like "10MB", "2.5GB", or "1TB".
-//
-//nolint:recvcheck // UnmarshalYAML requires a pointer; String/Int64 are value reads
 type Size int64
 
 // UnmarshalYAML implements yaml.Unmarshaler for Size, allowing it to be

internal/database/chunk_files.go

@@ -220,7 +220,7 @@ func (r *ChunkFileRepository) CreateBatch(
 				cf.ChunkHash.String(), cf.FileID.String(), cf.FileOffset, cf.Length)
 		}
 
-		query += querySb183.String() //nolint:gosec // G202: appends "?" placeholders only
+		query += querySb183.String()
 
 		query += " ON CONFLICT(chunk_hash, file_id) DO NOTHING"
 

internal/database/chunks.go

@@ -98,7 +98,7 @@ func (r *ChunkRepository) GetByHashes(
 		args[i] = hash
 	}
 
-	query += querySb75.String() //nolint:gosec // G202: appends "?" placeholders only
+	query += querySb75.String()
 
 	query += ") ORDER BY chunk_hash"
 

internal/database/file_chunks.go

@@ -253,7 +253,7 @@ func (r *FileChunkRepository) CreateBatch(
 			args = append(args, fc.FileID.String(), fc.Idx, fc.ChunkHash.String())
 		}
 
-		query += querySb211.String() //nolint:gosec // G202: appends "?" placeholders only
+		query += querySb211.String()
 
 		query += " ON CONFLICT(file_id, idx) DO NOTHING"
 

internal/database/files.go

@@ -341,7 +341,7 @@ func (r *FileRepository) CreateBatch(
 				f.LinkTarget.String())
 		}
 
-		query += querySb325.String() //nolint:gosec // G202: appends "?" placeholders only
+		query += querySb325.String()
 
 		query += ` ON CONFLICT(path) DO UPDATE SET
 			source_path = excluded.source_path,

internal/database/snapshots.go

@@ -395,7 +395,7 @@ func (r *SnapshotRepository) AddFilesByIDBatch(
 			args = append(args, snapshotID, fileID.String())
 		}
 
-		query += querySb312.String() //nolint:gosec // G202: appends "?" placeholders only
+		query += querySb312.String()
 
 		var err error
 		if tx != nil {

internal/globals/globals.go

@@ -72,9 +72,12 @@ func New() (*Globals, error) {
 // safe reading of "we could not establish that this is a release" is
 // that it is not one. The Makefile refuses to build at all in that
 // case; this is the second line of defence, for a binary linked by
-// something other than the Makefile.
+// something other than the Makefile. "unknown" counts for the same
+// reason: script/docker and script/cibuild stamp it when the host has
+// no git checkout.
 func IsDevVersion(v string) bool {
-	if v == "" || v == DevVersion || strings.HasPrefix(v, DevVersion+"-") ||
+	if v == "" || v == "unknown" || v == DevVersion ||
+		strings.HasPrefix(v, DevVersion+"-") ||
 		strings.HasSuffix(v, "-dirty") {
 		return true
 	}

internal/globals/globals_test.go

@@ -74,6 +74,9 @@ func TestIsDevVersion(t *testing.T) {
 		// as one. The Makefile refuses to build when script/version
 		// yields nothing; this covers a binary linked some other way.
 		{"", true},
+		// What script/docker and script/cibuild stamp when the host
+		// has no git checkout.
+		{"unknown", true},
 	}
 
 	for _, tc := range cases {

internal/snapshot/scanner.go

@@ -1345,8 +1345,7 @@ func (s *Scanner) processFileWithErrorHandling(
 		// record a file whose chunk is in no blob and cannot be restored, so
 		// abort the run even under --skip-errors. Only open and read errors
 		// are skipped below.
-		var pErr *packerError
-		if errors.As(err, &pErr) {
+		if _, ok := errors.AsType[*packerError](err); ok {
 			return false, fmt.Errorf("processing file %s: %w", fileToProcess.Path, err)
 		}
 		// Handle files that were deleted between scan and process phases

internal/storage/url.go

@@ -161,8 +161,7 @@ func rejectUnknownParams(query url.Values, allowed ...string) error {
 // *url.Error that url.Parse returns embeds the raw URL in its message, so
 // wrapping it directly would echo a credential-bearing URL into logs.
 func wrapParseError(err error) error {
-	var uerr *url.Error
-	if errors.As(err, &uerr) {
+	if uerr, ok := errors.AsType[*url.Error](err); ok {
 		return fmt.Errorf("invalid URL: %w", uerr.Err)
 	}