Skeleton, mnemonic input, derivation, and the ssh pub and priv commands (closes #1)

The module, the script entrypoints and Makefile, Docker-only linting, the mnemonic sources in the specified order with their refusals, the BIP-85 derivation, and keyfunc ssh pub and priv with the README test vectors as tests. Two review rounds; the second passed with no findings.

Model: opus-5 (implementation and review); fable-5-1 (landing)

script/lint

@@ -0,0 +1,18 @@
+#!/bin/sh
+# script/lint: run the linter. Linting only ever happens inside the
+# image built from Dockerfile.lint, which pins the linter by hash, so
+# the answer is the same on every machine and in CI. The linter runs as
+# a build step of that image, so a complaint fails the build and no
+# container is left behind.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build --progress=plain -f Dockerfile.lint \
+        -t "$("$SCRIPT_DIR/projectname")-lint" .
+}
+
+main "$@"