Skeleton, mnemonic input, derivation, and the ssh pub and priv commands (closes #1)

The module, the script entrypoints and Makefile, Docker-only linting, the mnemonic sources in the specified order with their refusals, the BIP-85 derivation, and keyfunc ssh pub and priv with the README test vectors as tests. Two review rounds; the second passed with no findings.

Model: opus-5 (implementation and review); fable-5-1 (landing)

Makefile

@@ -0,0 +1,47 @@
+# Makefile targets are thin shims; the implementations live in script/
+# per the scripts-to-rule-them-all pattern. The one exception is build,
+# which needs the version stamped into the binary.
+
+VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+LDFLAGS := -s -w -X 'git.eeqj.de/sneak/keyfunc/internal/cli.Version=$(VERSION)'
+
+.PHONY: default bootstrap setup build test lint fmt fmt-check check \
+	docker cibuild hooks clean
+
+default: check
+
+bootstrap:
+	@script/bootstrap
+
+setup:
+	@script/setup
+
+build:
+	go build -trimpath -ldflags "$(LDFLAGS)" -o keyfunc .
+
+test:
+	@script/test
+
+lint:
+	@script/lint
+
+fmt:
+	@script/fmt
+
+fmt-check:
+	@script/fmt-check
+
+check:
+	@script/check
+
+docker:
+	@script/docker
+
+cibuild:
+	@script/cibuild
+
+hooks:
+	@script/install-precommit
+
+clean:
+	rm -f keyfunc