Skeleton, mnemonic input, derivation, and the ssh pub and priv commands (closes #1)

The module, the script entrypoints and Makefile, Docker-only linting, the mnemonic sources in the specified order with their refusals, the BIP-85 derivation, and keyfunc ssh pub and priv with the README test vectors as tests. Two review rounds; the second passed with no findings.

Model: opus-5 (implementation and review); fable-5-1 (landing)

internal/mnemonic/mnemonic_test.go

@@ -0,0 +1,87 @@
+package mnemonic_test
+
+import (
+	"strings"
+	"testing"
+
+	"git.eeqj.de/sneak/keyfunc/internal/mnemonic"
+	"github.com/stretchr/testify/require"
+)
+
+// Two more mnemonics that pass the checksum, so a test can tell which
+// source an answer came from.
+const (
+	fromCommandVariable = "legal winner thank year wave sausage worth " +
+		"useful legal winner thank yellow"
+	fromVariable = "letter advice cage absurd amount doctor acoustic " +
+		"avoid letter advice cage above"
+)
+
+// example returns the mnemonic every BIP-39 document uses to show its
+// test vectors: eleven abandons and about.
+func example() string {
+	return strings.Repeat("abandon ", 11) + "about"
+}
+
+// broken returns a mnemonic whose last word does not match the rest.
+func broken() string {
+	return strings.TrimSpace(strings.Repeat("abandon ", 12))
+}
+
+// prints builds a shell command that writes the given words padded
+// with spaces, so the test also shows that the padding is dropped.
+func prints(words string) string {
+	return "printf '  %s  \\n' '" + words + "'"
+}
+
+func TestTheCommandOnTheCommandLineWins(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, prints(fromCommandVariable))
+	t.Setenv(mnemonic.Variable, fromVariable)
+
+	words, err := mnemonic.Read(t.Context(), prints(example()))
+	require.NoError(t, err)
+	require.Equal(t, example(), words)
+}
+
+func TestTheCommandInTheEnvironmentComesNext(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, prints(fromCommandVariable))
+	t.Setenv(mnemonic.Variable, fromVariable)
+
+	words, err := mnemonic.Read(t.Context(), "")
+	require.NoError(t, err)
+	require.Equal(t, fromCommandVariable, words)
+}
+
+func TestTheMnemonicInTheEnvironmentComesLast(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, "")
+	t.Setenv(mnemonic.Variable, "  "+fromVariable+"  ")
+
+	words, err := mnemonic.Read(t.Context(), "")
+	require.NoError(t, err)
+	require.Equal(t, fromVariable, words)
+}
+
+func TestAFailingCommandSaysWhatWentWrong(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, "")
+	t.Setenv(mnemonic.Variable, "")
+
+	_, err := mnemonic.Read(t.Context(), "echo nothing here >&2; exit 3")
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "nothing here")
+}
+
+func TestABadChecksumIsRefused(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, "")
+	t.Setenv(mnemonic.Variable, broken())
+
+	_, err := mnemonic.Read(t.Context(), "")
+	require.ErrorIs(t, err, mnemonic.ErrChecksum)
+}
+
+func TestNothingToReadAndNobodyToAsk(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, "")
+	t.Setenv(mnemonic.Variable, "")
+
+	_, err := mnemonic.Read(t.Context(), "")
+	require.ErrorIs(t, err, mnemonic.ErrMissing)
+}