Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)

Linting and testing become the lint and test phases of the Dockerfile,
and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and
the tests that checked them are removed. Every docker build in script/
passes --no-cache, and script/cibuild runs script/bootstrap first, which
now fetches apt package lists so a fresh CI runner can install Go. The
image takes its version from the VERSION build arg or git describe, dev
without .git, and still stamps the commit and its date. This repo's own
entries follow the canonical content in .gitignore and .editorconfig.
The golangci-lint v2.14.0 findings are fixed in the code. The rules in
CLAUDE.md move into AGENTS.md. IsDevVersion now counts "unknown".

Model: opus-5-5

script/docker

@@ -1,15 +1,8 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
-# The tag comes from script/projectname. Unlike the canonical copy in
-# sneak/prompts, it passes a fresh CHECK_EPOCH instead of --no-cache, and
-# COMMIT and COMMIT_DATE as well as VERSION.
-#
-# This builds the PRODUCT image only, and the product Dockerfile has no
-# lint stage: linting lives in Dockerfile.lint and is run by
-# script/lint. So a green here means `make fmt-check` and `make test`
-# passed and the image built -- it says nothing about lint. The gates
-# are script/check (which runs script/lint) and script/cibuild (which
-# builds both files).
+# Identical in all repos; the tag comes from script/projectname.
+# --no-cache because the gate phases the final stage depends on are RUN
+# steps, and a cached one is a check that did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -17,28 +10,14 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # Same CHECK_EPOCH contract as script/cibuild, for the same reason
-    # and with the same bare-assignment and `$$` requirements -- see the
-    # comments there. This script is not the CI gate, but a local build
-    # is almost always warm, so without this it would report a green the
-    # tree had not earned and the two entrypoints would disagree about
-    # whether the tree is clean.
-    epoch="$(date +%s%N)$$"
-
-    # Version, commit and build date are computed here on the host and
-    # passed into the build, where they take precedence over what the
-    # build would derive from the .git in its context. VERSION comes
-    # from script/version, as in the Makefile, so the image reports the
-    # same string, -dirty included, that a local build of the same tree
-    # would.
-    version="$("$SCRIPT_DIR/version")"
-    commit="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
-    commit_date="$(git show -s --format=%cs HEAD 2>/dev/null || echo unknown)"
-
-    docker build --build-arg CHECK_EPOCH="$epoch" \
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
         --build-arg VERSION="$version" \
-        --build-arg COMMIT="$commit" \
-        --build-arg COMMIT_DATE="$commit_date" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }