Move entrypoint to cmd/keyfunc

REPO_POLICIES.md keeps Go entrypoints under cmd/, one main.go per binary
whose body is a single call into internal/. Move the root main.go there
and point the Makefile build target at ./cmd/keyfunc; the binary is still
written to ./keyfunc. main.go is otherwise unchanged. (closes #20)

Model: opus-4-8

Makefile

@@ -17,7 +17,7 @@ setup:
 	@script/setup
 
 build:
-	go build -trimpath -ldflags "$(LDFLAGS)" -o keyfunc .
+	go build -trimpath -ldflags "$(LDFLAGS)" -o keyfunc ./cmd/keyfunc
 
 test:
 	@script/test