Re-vendor the shared files from sneak/prompts at dd4027b (closes #504)

Fetches the shared files unchanged from sneak/prompts commit dd4027b and
adds .prettierignore; .dockerignore keeps this repository's anchored host
artifacts at its end.

Linting moves into the Dockerfile's lint phase on the golangci-lint
v2.14.0 image, which also runs the js-lint stage, and Dockerfile.lint is
gone. Tests move into a test phase on the golang bookworm image.
script/lint, test, docker and cibuild are the model scripts, every docker
build in script/ passes --no-cache, and the .ci-fingerprint barrier is
gone. The workflow no longer calls script/ci-mark-superseded, so it and
its tests are removed. make build passes -trimpath and -s -w.

Model: opus-5-5

Makefile

@@ -19,6 +19,10 @@ override VERSION := $(or $(strip $(VERSION)),$(shell script/version))
 # Extra linker flags for the build target. The static relink in the
 # Dockerfile adds -extldflags here rather than passing its own -ldflags,
 # so composing flags cannot drop the version stamp.
+#
+# The build target itself always passes -trimpath and -s -w, as the Go
+# Dockerfile in REPO_POLICIES.md does: no build paths, symbol table or
+# debug information in the binary.
 GO_LDFLAGS ?=
 
 bootstrap:
@@ -49,7 +53,7 @@ check:
 	@script/check
 
 build: assets
-	go build -ldflags '$(strip -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker
+	go build -trimpath -ldflags '$(strip -s -w -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker
 
 run: build
 	./bin/webhooker