Re-vendor the shared files from sneak/prompts at dd4027b (closes #504)

Fetches the shared files unchanged from sneak/prompts commit dd4027b and
adds .prettierignore; .dockerignore keeps this repository's anchored host
artifacts at its end.

Linting moves into the Dockerfile's lint phase on the golangci-lint
v2.14.0 image, which also runs the js-lint stage, and Dockerfile.lint is
gone. Tests move into a test phase on the golang bookworm image.
script/lint, test, docker and cibuild are the model scripts, every docker
build in script/ passes --no-cache, and the .ci-fingerprint barrier is
gone. The workflow no longer calls script/ci-mark-superseded, so it and
its tests are removed. make build passes -trimpath and -s -w.

Model: opus-5-5

.gitignore

@@ -1,54 +1,47 @@
-# Binaries
-*.exe
-*.dll
-*.so
-*.dylib
-bin/
-/webhooker
-
-# Test binary, built with `go test -c`
-*.test
-
-# Output of the go coverage tool
-*.out
-
-# Go vendor directory
-vendor/
-
-# ESLint, prettier and their dependencies, installed from yarn.lock
-node_modules/
-
-# IDE specific files
-.idea/
-*.swp
-*.swo
-*~
-.vscode/
-
-# OS specific files
+# OS
 .DS_Store
 Thumbs.db
 
-# Environment and config files
-.env
-.env.local
+# Editors
+*.swp
+*.swo
+*~
+*.bak
+.idea/
+.vscode/
+*.sublime-*
 
-# Data directory (SQLite databases)
-data/
-*.db
-*.sqlite
-*.sqlite3
+# Agent scratch (worktrees of this repo, created and destroyed by
+# in-flight tooling). Unanchored: .gitignore patterns already match at
+# every depth, so no prefix is wanted here. This is not a .dockerignore
+# entry and must not be given a `**/` prefix on the way into one.
+.claude/
 
-# Log files
-*.log
+# Node
+node_modules/
 
-# Temporary files
-tmp/
-temp/
+# Secrets. Unanchored like every entry above, so each matches at every
+# depth. Matching is case-sensitive on Linux, so names use character
+# ranges rather than a lowercase form that misses `Server.Key`.
 
-# CI cache barrier, written into the build context by the check workflow
-.ci-fingerprint
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Only the templates `example.env` and `sample.env` are
+# re-included below. A repository that commits any other template adds
+# its own negation after these lines, for example `!.env.example`.
+*.[eE][nN][vV]
+.[eE][nN][vV].*
+.[eE][nN][vV][rR][cC]
+!example.env
+!sample.env
 
-# Alpine.js, extracted by `make assets` from its tarball in 3p/, which is
-# what is committed.
-/static/js/alpine.min.js
+# Private keys and the bundles carrying them.
+*.[pP][eE][mM]
+*.[kK][eE][yY]
+*.[pP]12
+*.[pP][fF][xX]
+[iI][dD]_[rR][sS][aA]
+[iI][dD]_[dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
+[iI][dD]_[eE][dD]25519
+[iI][dD]_[eE][dD]25519_[sS][kK]