Format the Markdown with prettier in make fmt and make fmt-check (closes #215)

`make fmt` formatted only Go, so the org's Markdown settings were unenforced and Markdown was wrapped by hand. prettier, pinned in `package.json` and `yarn.lock` beside ESLint, now formats the Markdown with `.prettierrc` (4-space tabs, `proseWrap: always`). It runs only in Docker: `make fmt` writes the formatted files back without a bind mount, and `make fmt-check`, `make check` and the image build fail on unformatted Markdown. The image build's lint stage now runs the Go format check directly and no longer installs `make`. `README.md` and `TODO.md` are reformatted with no word changed: the README reflows from 72 to 80 columns.

Model: opus-5-5

Dockerfile

@@ -4,8 +4,6 @@
 # compile on Alpine musl (off64_t is a glibc type).
 FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
 
-RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
-
 WORKDIR /src
 
 # Copy go mod files first for better layer caching
@@ -19,12 +17,14 @@ RUN go mod download
 # .dockerignore.
 COPY . .
 
-# Run formatting check and linter. golangci-lint is invoked directly rather
-# than through `make lint`: this stage is already the pinned linter image, and
-# script/lint is a wrapper that builds Dockerfile.lint, so calling it here
-# would need a docker daemon inside the build. Keep these steps in step with
-# Dockerfile.lint, including --network=none (see its header for why).
-RUN make fmt-check
+# Run the Go formatting check and the linter. gofmt and golangci-lint are
+# invoked directly rather than through `make fmt-check` and `make lint`: this
+# stage is already the pinned linter image, and both scripts build docker
+# stages, so calling them here would need a docker daemon inside the build.
+# The Markdown half of `make fmt-check` is the markdown-check stage below.
+# Keep the golangci-lint steps in step with Dockerfile.lint, including
+# --network=none (see its header for why).
+RUN if [ -n "$(gofmt -s -l .)" ]; then echo "gofmt needed on:"; gofmt -s -l .; exit 1; fi
 RUN script/assets
 RUN --network=none golangci-lint config verify --config .golangci.yml
 RUN --network=none golangci-lint run --config .golangci.yml --build-tags browser ./...
@@ -66,10 +66,11 @@ RUN sed 's/}/}\n/g' static/css/tailwind.css > /tmp/committed.css \
     }
 
 # JavaScript lint stages: ESLint, at the version package.json and yarn.lock
-# pin, checks static/js/ against eslint.config.mjs. js-deps installs it and
-# stays cached until those two files change. script/lint forces only js-lint
-# to re-run, and the build stage below runs it too. COPY . . brings in the CI
-# cache barrier described in the lint stage above.
+# pin, checks static/js/ against eslint.config.mjs. js-deps installs it, and
+# prettier for the Markdown stages below, and stays cached until those two
+# files change. script/lint forces only js-lint to re-run, and the build stage
+# below runs it too. COPY . . brings in the CI cache barrier described in the
+# lint stage above.
 # node:24.21.0-alpine (LTS, with yarn 1.22.22), 2026-09-18
 FROM node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 AS js-deps
 WORKDIR /src
@@ -80,16 +81,36 @@ FROM js-deps AS js-lint
 COPY . .
 RUN --network=none node_modules/.bin/eslint static/js
 
+# Markdown stages: prettier, at the version package.json and yarn.lock pin,
+# formats every Markdown file in the tree with the settings in .prettierrc.
+# `make fmt` (script/fmt) writes the formatted files out from markdown-output.
+# markdown-check fails on any file prettier would change; `make fmt-check`
+# runs it, and so does the build stage below.
+FROM js-deps AS markdown
+COPY . .
+RUN --network=none node_modules/.bin/prettier --write '**/*.md' \
+    && mkdir /out \
+    && find . -name '*.md' ! -path './node_modules/*' -exec cp -p --parents {} /out \;
+
+FROM scratch AS markdown-output
+COPY --from=markdown /out /
+
+FROM js-deps AS markdown-check
+COPY . .
+RUN --network=none node_modules/.bin/prettier --check '**/*.md'
+
 # Build stage
 # golang:1.26.1-bookworm (Debian-based), 2026-03-17
 # Using Debian-based image because gorm.io/driver/sqlite pulls in
 # mattn/go-sqlite3 (CGO), which does not compile on Alpine musl.
 FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS builder
 
-# Depend on the lint, stylesheet check and JavaScript lint stages passing
+# Depend on the lint, stylesheet check, JavaScript lint and Markdown check
+# stages passing
 COPY --from=lint /src/go.sum /dev/null
 COPY --from=css-check /out/tailwind.css /dev/null
 COPY --from=js-lint /src/yarn.lock /dev/null
+COPY --from=markdown-check /src/yarn.lock /dev/null
 
 # jq is a runtime dependency of script/ci-mark-superseded, which the test
 # suite executes. git is what script/version derives the version with.