REPO_POLICIES.md keeps Go entrypoints under cmd/, one main.go per binary
whose body is a single call into internal/. Move the root main.go there
and point the Makefile build target at ./cmd/keyfunc; the binary is still
written to ./keyfunc. main.go is otherwise unchanged. (closes#20)
Model: opus-4-8
