Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Add the standard scaffold and bring the tree to a clean lint under the
vendored `default: all` config: `script/` Scripts-to-Rule-Them-All
entrypoints with the `Makefile` as thin shims; a `Dockerfile` whose
`lint` and `test` phases gate the build; `.gitea/workflows/` CI running
`script/cibuild`; `REPO_POLICIES.md`, `.editorconfig`, `.dockerignore`,
`LICENSE` (WTFPL), `TODO.md`, `.gitignore`. The `.golangci.yml` is
byte-identical to the canonical copy in the `prompts` repo
(`https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`).

The 211 lint findings were fixed, not suppressed: package globals became
functions/fields/a command constructor, magic numbers became named
constants, `ctx` threads into the probes, loop functions were split to
cut complexity. Behavior is unchanged; the log file mode stays `0644`.
Four `//nolint:gosec` remain — G204 on the fixed-argv subprocess calls,
G304 on the operator-chosen log file — matching the reference repos.

`make check` is green (lint and tests run in Docker).

Model: opus-4-8

Makefile

@@ -1,40 +1,52 @@
-.PHONY: test lint fmt build run-local clean all copy run
+.PHONY: bootstrap setup test lint fmt fmt-check check build run dev deps \
+	docker cibuild clean hooks
 
-# Default target
-default: test
+# Target bodies live in script/ (Scripts to Rule Them All); the targets
+# below are thin shims that call them.
+.DEFAULT_GOAL := check
 
-# Build the binary
-build:
-	go build -o rtnetmon ./cmd/rtnetmon
+bootstrap:
+	@script/bootstrap
 
-# Run tests
-test: lint
-	go test -v ./...
+setup:
+	@script/setup
+
+test:
+	@script/test
 
-# Run linter
 lint:
-	golangci-lint run --config .golangci.yml ./...
+	@script/lint
 
-# Format code
 fmt:
-	go fmt ./...
+	@script/fmt
 
-# Run the application locally
-run-local: build
-	./rtnetmon
+fmt-check:
+	@script/fmt-check
+
+check:
+	@script/check
+
+docker:
+	@script/docker
+
+cibuild:
+	@script/cibuild
+
+hooks:
+	@script/install-precommit
+
+build:
+	CGO_ENABLED=0 go build -trimpath -o bin/rtnetmon ./cmd/rtnetmon
+
+run: build
+	./bin/rtnetmon
+
+dev:
+	go run ./cmd/rtnetmon
+
+deps:
+	go mod download
+	go mod tidy
 
-# Clean build artifacts
 clean:
-	rm -f rtnetmon
-	rm -f main.go.old
-
-# Build and test everything
-all: fmt lint test build
-
-# Remote deployment targets
-copy:
-	ssh root@las1stor1 -v "mkdir -p /tmp/x"
-	rsync -av --exclude='.git' --exclude='*.test' --exclude='/rtnetmon' --exclude='main.go.old' ./ root@las1stor1:/tmp/x/
-
-run: copy
-	ssh -t root@las1stor1 -v "cd /tmp/x && go run ./cmd/rtnetmon"
+	rm -rf bin/