Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first. The
image takes its version from the VERSION build arg or git describe, and
still stamps the commit and its date from .git. The golangci-lint
v2.14.0 findings are fixed in the code. The rules in CLAUDE.md move into
AGENTS.md. IsDevVersion now counts "unknown", the version script/docker
stamps outside a git checkout.

Model: opus-5-5

script/install-go

@@ -7,8 +7,9 @@
 # Only .gitea/workflows/release.yml calls this. goreleaser is not a
 # compiler: it shells out to `go` for the `before:` hook and for every
 # one of the four cross-compiles, so the release runner needs a Go
-# toolchain on PATH. check.yml never does -- it builds inside the
-# digest-pinned Dockerfile images -- so this is the release path's only
+# toolchain on PATH. check.yml compiles nothing on the host: its one
+# host use of Go is gofmt in script/fmt-check, with whatever Go
+# script/bootstrap finds or installs. So this is the release path's only
 # host Go, and per REPO_POLICIES.md it must be pinned by hash.
 # actions/setup-go exposes no checksum input, so Go is installed the way
 # script/install-goreleaser installs goreleaser: download the exact
@@ -18,7 +19,8 @@
 # The version is go.mod's `go` directive, the single source of truth for
 # the toolchain. GO_VERSION below MUST equal it, and this script fails
 # when they disagree -- so bumping Go is one reviewed change touching
-# go.mod, the checksum here, and the Dockerfile golang digest together.
+# go.mod, the checksum here, and the Dockerfile's two golang digests
+# together.
 #
 # Linux only, because that is what the release runner is. A darwin dev
 # building a snapshot uses their own Go; supporting an OS means adding