Skeleton, mnemonic input, derivation, and the ssh commands (closes #1)

The tool derives ed25519 SSH keys from a BIP-39 mnemonic and prints
them, either as an authorized_keys line or as an unencrypted OpenSSH
private key. Both README test vectors are asserted in the tests.

The mnemonic is looked for in the order the README gives, and refused
when it fails its checksum or when there is nowhere left to look.

The repository standards come with it: the vendored linter
configuration and policies, the script/ entrypoints with a thin
Makefile, and a Gitea workflow. Linting happens only inside the image
built from Dockerfile.lint, which pins the linter by hash, so the root
Dockerfile runs the formatting check, the tests and the build, and
script/cibuild runs the linter before it.

Model: opus-5

internal/sshkey/sshkey_test.go

@@ -0,0 +1,68 @@
+package sshkey_test
+
+import (
+	"strings"
+	"testing"
+
+	"git.eeqj.de/sneak/keyfunc/internal/derive"
+	"git.eeqj.de/sneak/keyfunc/internal/sshkey"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+
+// example returns the mnemonic every BIP-39 document uses to show its
+// test vectors: eleven abandons and about.
+func example() string {
+	return strings.Repeat("abandon ", 11) + "about"
+}
+
+func TestTooFewBytesAreRefused(t *testing.T) {
+	t.Parallel()
+
+	_, err := sshkey.New([]byte("short"))
+	require.ErrorIs(t, err, sshkey.ErrSize)
+}
+
+func TestTheCommentIsPutAtTheEndOfTheLine(t *testing.T) {
+	t.Parallel()
+
+	key := forIndex(t, 0)
+
+	line, err := key.Line("hello")
+	require.NoError(t, err)
+	require.True(t, strings.HasPrefix(line, "ssh-ed25519 "))
+	require.True(t, strings.HasSuffix(line, " hello"))
+}
+
+func TestThePrivateKeyCarriesTheSamePublicKey(t *testing.T) {
+	t.Parallel()
+
+	key := forIndex(t, 0)
+
+	line, err := key.Line("")
+	require.NoError(t, err)
+
+	block, err := key.Block("a comment")
+	require.NoError(t, err)
+
+	parsed, err := ssh.ParsePrivateKey([]byte(block))
+	require.NoError(t, err)
+
+	back := strings.TrimSpace(
+		string(ssh.MarshalAuthorizedKey(parsed.PublicKey())),
+	)
+	require.Equal(t, line, back)
+}
+
+// forIndex derives the key for one index.
+func forIndex(t *testing.T, index uint32) *sshkey.Key {
+	t.Helper()
+
+	material, err := derive.Bytes(example(), sshkey.Application, index)
+	require.NoError(t, err)
+
+	key, err := sshkey.New(material)
+	require.NoError(t, err)
+
+	return key
+}