bring the repo up to org standards

Adopt the standard tooling: a Makefile of thin shims over a full
scripts-to-rule-them-all `script/` set, the canonical `.golangci.yml`
vendored byte-identical from `sneak/prompts`, docker-only linting via
`Dockerfile.lint`, a `Dockerfile` and Gitea workflow that gate every
push, and prettier/editorconfig/dockerignore config.

`make build` pointed at a `cmd/dcfinfo` that is not in the tree and
could never have succeeded; this repo is a library, so `build` is now
the compile check over every package.

Clear the 57 findings the canonical linter config reports on `pkg/dcf`.
Two were real: `findDCFMountPoints` checked a never-assigned `erro`
instead of the error from `findAllMountPoints`, discarding it, and
`privatePath` was computed twice so the first computation was dead.
Mountpoint selection otherwise behaves exactly as before; the defects
that survive are filed as issue #6, not fixed here.

Rename `DCFStore` to `Store` and `DCFObject` to `Object` (with its
`DCFStoreRoot` field to `StoreRoot`), which revive's stutter rule
requires and which the `fs.FS` rework in issue #4 will build on.

Replace the placeholder test with tests over the exported surface.
The filesystem walk stays uncovered: it is reachable only through
`GetDCFStores`, which needs real mounted media.

README keeps its content, reorganised into the required sections and
gaining Entrypoints.

(closes #1)

script/repo-source-manifest

@@ -0,0 +1,60 @@
+#!/bin/sh
+# script/repo-source-manifest: print every file this repository contains
+# whose absence from a docker build context would go unnoticed — one
+# repo-relative path per line, LC_ALL=C-sorted.
+#
+# That is the Go sources. A missing go.mod, go.sum or .golangci.yml
+# fails the build loudly (the COPY errors, or golangci-lint refuses to
+# start), so they cannot hide anything; they are listed anyway because
+# it costs two lines and makes the manifest the linter's whole input
+# rather than most of it.
+#
+# The list comes from the git index, never from a walk of the working
+# tree, and that is the point: script/assert-context-complete compares
+# it against the inventory the build itself emitted, and a check that
+# reads its expectation from the same place it reads its evidence proves
+# nothing. .dockerignore governs what docker sends; it cannot touch what
+# git tracks.
+#
+# Tracked files only, and only those present in the worktree — a file
+# staged for deletion is not something the build context is missing.
+# Untracked files are not expected either, so local scratch work in the
+# tree is not a failure.
+#
+# A path containing a newline or a quote is quoted by git and will not
+# match the plain path the build emits, so it fails loudly rather than
+# passing silently. No such path exists here, and none should.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+die() {
+    echo "script/repo-source-manifest: $*" >&2
+    exit 1
+}
+
+main() {
+    cd "$ROOT"
+
+    git rev-parse --is-inside-work-tree >/dev/null 2>&1 ||
+        die "not a git work tree, so there is nothing to compare a build context against"
+
+    # Captured before the loop so that a git failure is the script's
+    # exit status: in a pipeline only the last command's status counts.
+    tracked="$(git ls-files -- '*.go' go.mod go.sum .golangci.yml .golangci.yaml)"
+
+    manifest="$(
+        printf '%s\n' "$tracked" | while IFS= read -r f; do
+            if [ -n "$f" ] && [ -f "$f" ]; then
+                printf '%s\n' "$f"
+            fi
+        done | LC_ALL=C sort
+    )"
+
+    [ -n "$manifest" ] ||
+        die "the git index lists no Go sources, so any build context would satisfy the check"
+
+    printf '%s\n' "$manifest"
+}
+
+main "$@"