Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first, which
now fetches apt package lists so a fresh CI runner can install Go. The
image takes its version from the VERSION build arg or git describe, dev
without .git, and still stamps the commit and its date. This repo's own
entries follow the canonical content in .gitignore and .editorconfig.
The golangci-lint v2.14.0 findings are fixed in the code. The rules in
CLAUDE.md move into AGENTS.md. IsDevVersion now counts "unknown".

Model: opus-5-5

.gitea/workflows/release.yml

@@ -16,11 +16,12 @@ jobs:
           fetch-depth: 0
       # goreleaser is not a compiler: it shells out to `go` for the
       # `before:` hook and for every one of the four cross-compiles.
-      # Nothing else in this repo puts a Go toolchain on the runner --
-      # check.yml runs script/cibuild, which does all of its work inside
-      # the digest-pinned Dockerfile images -- so without this step the
-      # release either fails at the before-hook or, worse, ships binaries
-      # built by whatever Go the runner happens to carry.
+      # Without this step the release either fails at the before-hook or,
+      # worse, ships binaries built by whatever Go the runner happens to
+      # carry. check.yml's script/cibuild also puts Go on its own runner,
+      # through script/bootstrap from the package manager at whatever
+      # version that ships, but uses it only for `go mod download` and
+      # gofmt; it compiles inside the digest-pinned Dockerfile images.
       #
       # actions/setup-go would pin the action by commit sha, but the Go
       # tarball it downloads at runtime is verified against no value in