Skeleton, mnemonic input, derivation, and the ssh pub and priv commands (closes #1)

The module, the script entrypoints and Makefile, Docker-only linting, the mnemonic sources in the specified order with their refusals, the BIP-85 derivation, and keyfunc ssh pub and priv with the README test vectors as tests. Two review rounds; the second passed with no findings.

Model: opus-5 (implementation and review); fable-5-1 (landing)

Dockerfile

@@ -0,0 +1,26 @@
+# The formatting check, the tests and the build. Linting is not here:
+# it runs in its own pinned image, see Dockerfile.lint and script/lint,
+# which script/cibuild runs before this file.
+
+# golang:1.26-alpine, 2026-09-07
+FROM golang@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628 AS builder
+
+RUN apk add --no-cache make git
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN make fmt-check
+RUN make test
+RUN make build
+
+# alpine:3.23, 2026-09-07
+FROM alpine@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40
+
+COPY --from=builder /src/keyfunc /usr/local/bin/keyfunc
+
+ENTRYPOINT ["keyfunc"]