bring the repo up to repo standards (closes #1)

Adopt the standard tooling from sneak/prompts: the Makefile and script/
entrypoints, lint and test stages in one Dockerfile, the canonical lint
config, the CI workflow and the formatter settings. make fmt also formats
Go, using a pinned Go that script/bootstrap installs. Change the module
path to sneak.berlin/go/dcf.

Fix the lint findings in pkg/dcf in place. DCFStore becomes Store and
DCFObject becomes Object. Three behaviours change. An error listing mount
points is now returned, where a typo used to drop it. Store.String() prints
Store{ instead of DCFStore{. It prints a negative total as 0 B instead of a
huge size.

Replace the placeholder test with real tests. Move the README into the
required sections. make build now compiles the library; it pointed at a
command that does not exist.

Model: opus-5-5

Dockerfile

@@ -0,0 +1,64 @@
+# Lint phase. The linter is invoked directly rather than through `make
+# lint` or `script/lint`, which are themselves a docker build and would
+# recurse into a daemon that does not exist in a build step.
+#
+# golangci/golangci-lint:v2.12.2, 2026-11-02
+FROM golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN golangci-lint run --config .golangci.yml ./...
+
+# Test phase, invoked directly for the same reason. The Debian image has
+# the C compiler the race detector needs.
+#
+# golang:1.27.3-trixie, 2026-11-02. It carries the Go that
+# script/bootstrap installs on the host; change both together, and the
+# same image in the last stage.
+FROM golang@sha256:c65ecfe613b539ac74c62a4c3b2c27e8f8a6076384c8f27e8a3c0f3be17cc385 AS test
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN go test -count=1 -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -count=1 -timeout 90s -race -v ./...; exit 1; }
+
+# Development environment, and the last stage: a plain `docker build .`
+# names no target and so builds this one. Nothing is wanted from the two
+# phases above; the copies are what make BuildKit build them first, so
+# this image cannot be produced unless lint and test passed. A stage
+# appended after this one would drop all three out of a plain build.
+#
+# golang:1.27.3-trixie, 2026-11-02
+FROM golang@sha256:c65ecfe613b539ac74c62a4c3b2c27e8f8a6076384c8f27e8a3c0f3be17cc385
+
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null
+
+WORKDIR /src
+
+# script/bootstrap finds its pinned Go already in this image. It installs
+# the Go modules and the tools for formatting Markdown. Debian is used
+# here because the node it installs needs glibc.
+COPY script/ script/
+COPY package.json yarn.lock go.mod go.sum ./
+RUN script/bootstrap
+
+COPY . .
+
+RUN script/build
+
+# The version is computed on the host and passed in, because
+# .dockerignore excludes .git.
+ARG VERSION=dev
+LABEL org.opencontainers.image.version="${VERSION}"