Skeleton, mnemonic input, derivation, and the ssh pub and priv commands (closes #1)

The module, the script entrypoints and Makefile, Docker-only linting, the mnemonic sources in the specified order with their refusals, the BIP-85 derivation, and keyfunc ssh pub and priv with the README test vectors as tests. Two review rounds; the second passed with no findings.

Model: opus-5 (implementation and review); fable-5-1 (landing)

internal/cli/cli.go

@@ -0,0 +1,48 @@
+// Package cli builds the command tree and runs it.
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"git.eeqj.de/sneak/keyfunc/internal/cli/options"
+	"git.eeqj.de/sneak/keyfunc/internal/cli/ssh"
+	"github.com/spf13/cobra"
+)
+
+// Version is what --version prints. The build sets it.
+//
+//nolint:gochecknoglobals // set at build time with -ldflags
+var Version = "dev"
+
+// Root returns the whole command tree.
+func Root() *cobra.Command {
+	root := &cobra.Command{
+		Use:   "keyfunc",
+		Short: "derive key pairs from a BIP-39 mnemonic",
+		Long: "keyfunc turns a BIP-39 mnemonic into key pairs that can " +
+			"be recreated from that mnemonic at any time. The same " +
+			"mnemonic, key type and index always give the same key.",
+		Version:       Version,
+		SilenceUsage:  true,
+		SilenceErrors: true,
+	}
+
+	options.Add(root)
+	root.AddCommand(ssh.Command())
+
+	return root
+}
+
+// Main runs the tool and returns the status the process should exit
+// with.
+func Main() int {
+	err := Root().Execute()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "keyfunc: "+err.Error())
+
+		return 1
+	}
+
+	return 0
+}