bring the repo up to org standards

Adopt the standard tooling: a Makefile of thin shims over a full
scripts-to-rule-them-all `script/` set, the canonical `.golangci.yml`
vendored byte-identical from `sneak/prompts`, docker-only linting via
`Dockerfile.lint`, a `Dockerfile` and Gitea workflow that gate every
push, and prettier/editorconfig/dockerignore config.

`make build` pointed at a `cmd/dcfinfo` that is not in the tree and
could never have succeeded; this repo is a library, so `build` is now
the compile check over every package.

Clear the 57 findings the canonical linter config reports on `pkg/dcf`.
Two were real: `findDCFMountPoints` checked a never-assigned `erro`
instead of the error from `findAllMountPoints`, discarding it, and
`privatePath` was computed twice so the first computation was dead.
Mountpoint selection otherwise behaves exactly as before; the defects
that survive are filed as issue #6, not fixed here.

Rename `DCFStore` to `Store` and `DCFObject` to `Object` (with its
`DCFStoreRoot` field to `StoreRoot`), which revive's stutter rule
requires and which the `fs.FS` rework in issue #4 will build on.

Replace the placeholder test with tests over the exported surface.
The filesystem walk stays uncovered: it is reachable only through
`GetDCFStores`, which needs real mounted media.

README keeps its content, reorganised into the required sections and
gaining Entrypoints.

(closes #1)

Dockerfile

@@ -0,0 +1,83 @@
+# This repo is a library: there is no cmd/ and no binary to ship, so the
+# build ends at the stage that compiles and tests the packages. There is
+# no runtime stage because there is nothing to run.
+
+# Lint stage — fast feedback on formatting and lint issues. Tools are
+# invoked directly (not via make/script): the docker build is its own
+# single path.
+# This stage must stay the one that runs golangci-lint, and its name must
+# match $lint_stage in script/cibuild, which cache-busts it by name.
+# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-30
+FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+
+WORKDIR /src
+
+# Copy go mod files first for better layer caching
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy source code
+COPY . .
+
+# Inventory of the sources that actually arrived here. script/cibuild
+# reads these lines out of the build log and compares them against the
+# git index, so a .dockerignore entry or a narrowed COPY that hides a
+# package fails the run instead of yielding a clean report over a tree
+# the linter never saw. Keep it immediately after `COPY . .`, and keep
+# `echo context-manifest-begin` as its first command:
+# script/assert-context-complete matches the step by that prefix.
+RUN echo context-manifest-begin; \
+    { find . -type f -name '*.go'; \
+      for f in go.mod go.sum .golangci.yml .golangci.yaml; do \
+          if [ -f "$f" ]; then echo "./$f"; fi; \
+      done; } \
+    | sed 's|^\./||' | LC_ALL=C sort | sed 's|^|context-file: |'; \
+    echo context-manifest-end
+
+# Formatting check, config check, linter
+RUN test -z "$(gofmt -s -l .)" || { echo "gofmt needed on:"; gofmt -s -l .; exit 1; }
+RUN golangci-lint config verify --config .golangci.yml
+RUN golangci-lint run --config .golangci.yml ./...
+
+# Build stage, and the last one: script/cibuild passes no --target, so
+# BuildKit builds whichever stage is last and appending one drops lint,
+# builder and their checks out of the run. Must stay the stage that runs
+# go test, and its name must match $test_stage in script/cibuild, which
+# cache-busts it by name.
+# golang:1.25.7-bookworm (Debian-based: the race detector used by the
+# test run requires glibc), 2026-08-30
+FROM golang:1.25.7-bookworm@sha256:564e366a28ad1d70f460a2b97d1d299a562f08707eb0ecb24b659e5bd6c108e1 AS builder
+
+# Depend on lint stage passing (forces BuildKit ordering)
+COPY --from=lint /src/go.sum /dev/null
+
+WORKDIR /build
+
+# Copy go mod files first for better layer caching
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy source code
+COPY . .
+
+# Same inventory as the lint stage, and separately checked: this stage
+# has its own COPY, so an intact context over there is no evidence about
+# the tree `go test ./...` is about to walk here. A package that did not
+# arrive is a package the tests never run, and the run still ends `ok`.
+RUN echo context-manifest-begin; \
+    { find . -type f -name '*.go'; \
+      for f in go.mod go.sum .golangci.yml .golangci.yaml; do \
+          if [ -f "$f" ]; then echo "./$f"; fi; \
+      done; } \
+    | sed 's|^\./||' | LC_ALL=C sort | sed 's|^|context-file: |'; \
+    echo context-manifest-end
+
+# Run tests: quiet first, verbose rerun on failure (and still fail).
+# -count=1 disables the test result cache, matching script/test.
+RUN go test -count=1 -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -count=1 -timeout 90s -race -v ./...; exit 1; }
+
+# No binary to emit, so the compile check is the artifact: it proves every
+# package builds for the target the library claims to support.
+RUN CGO_ENABLED=0 go build -trimpath ./...