Adopt the scripts-to-rule-them-all layout and the canonical Docker gates

script/ holds the entrypoints and the Makefile targets shim to them.
Linting and testing are phases of the Dockerfile, built alone by
script/lint and script/test with a fresh CACHEBUST value and cache
mounts for Go's build cache and golangci-lint's; the build stage
depends on both, and the runtime stage ships the binary and the source
without .git. Formatting stays on the host in script/fmt and
script/fmt-check (gofmt and the prettier pinned in yarn.lock).
script/cibuild bootstraps, runs script/check and builds the tagged
image, and the Gitea workflow calls it. script/precommit refuses a
commit whose go.mod or go.sum is not tidy.

cgo stays off, so the test phase runs on the alpine Go image without
-race; that is the one departure from the canonical Go Dockerfile.

Re-vendored from the prompts repository's next branch: REPO_POLICIES.md
(2026-11-04), .golangci.yml (byte-identical, so the local
exhaustruct_v5 addition is gone now that canonical carries it),
.gitea/workflows/check.yml, .editorconfig, .gitignore and .dockerignore,
the last two followed by this repository's own entries. AGENTS.md holds
the repository-specific guidance for agents. The README gains the
Entrypoints section and describes the new gates.

AGENTS.md

@@ -0,0 +1,19 @@
+# AGENTS.md
+
+Guidance for coding agents working in this repository. The repository policies
+are in `REPO_POLICIES.md`, vendored from the `prompts` repository; read that
+first. Everything below is specific to this repository, and the README's Design
+section explains each point.
+
+- `pkg/` holds only packages designed to be imported by other programs. Anything
+  that exists to support `sutil` lives under `internal/`.
+- `sutil` is not a command-line front end for the packages in `pkg/`. It holds
+  only the utilities the author wants available everywhere; a command is added
+  because a tool is wanted, not because a package exists.
+- `pkg/cbk` derives crypto_box keypairs from BIP39 mnemonics with BIP85 and does
+  nothing else. BIP39 passphrases are deliberately unsupported.
+- cgo stays off: builds are static, and the test phase runs without `-race`.
+- Version tags are created by the author alone, when the author decides. Do not
+  propose, schedule, or create tags.
+- `.golangci.yml` is byte-identical to the canonical copy and is not edited
+  here; changes go to the `prompts` repository.