Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first. The
image takes its version from the VERSION build arg or git describe, and
still stamps the commit and its date from .git. The golangci-lint
v2.14.0 findings are fixed in the code. The rules in CLAUDE.md move into
AGENTS.md. IsDevVersion now counts "unknown", the version script/docker
stamps outside a git checkout.

Model: opus-5-5

internal/globals/globals.go

@@ -72,9 +72,12 @@ func New() (*Globals, error) {
 // safe reading of "we could not establish that this is a release" is
 // that it is not one. The Makefile refuses to build at all in that
 // case; this is the second line of defence, for a binary linked by
-// something other than the Makefile.
+// something other than the Makefile. "unknown" counts for the same
+// reason: script/docker and script/cibuild stamp it when the host has
+// no git checkout.
 func IsDevVersion(v string) bool {
-	if v == "" || v == DevVersion || strings.HasPrefix(v, DevVersion+"-") ||
+	if v == "" || v == "unknown" || v == DevVersion ||
+		strings.HasPrefix(v, DevVersion+"-") ||
 		strings.HasSuffix(v, "-dirty") {
 		return true
 	}