Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Add the standard scaffold and bring the tree to a clean lint under the
vendored `default: all` config: `script/` Scripts-to-Rule-Them-All
entrypoints with the `Makefile` as thin shims; a `Dockerfile` whose
`lint` and `test` phases gate the build; `.gitea/workflows/` CI running
`script/cibuild`; `REPO_POLICIES.md`, `.editorconfig`, `.dockerignore`,
`LICENSE` (WTFPL), `TODO.md`, `.gitignore`. The `.golangci.yml` is
byte-identical to the canonical copy in the `prompts` repo
(`https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`).

The 211 lint findings were fixed, not suppressed: package globals became
functions/fields/a command constructor, magic numbers became named
constants, `ctx` threads into the probes, loop functions were split to
cut complexity. Behavior is unchanged; the log file mode stays `0644`.
Four `//nolint:gosec` remain — G204 on the fixed-argv subprocess calls,
G304 on the operator-chosen log file — matching the reference repos.

`make check` is green (lint and tests run in Docker).

Model: opus-4-8

README.md

@@ -1,6 +1,8 @@
 # rtnetmon
 
-Real-time network monitoring dashboard for Linux systems with dual-interface support.
+rtnetmon is a WTFPL-licensed Go terminal (CLI/TUI) network monitor by
+[@sneak](https://sneak.berlin) that shows real-time network health, packet
+loss, and latency across two Linux network interfaces at once.
 
 ## Overview
 
@@ -34,13 +36,13 @@ for a clean, real-time dashboard interface.
 ```bash
 git clone https://git.eeqj.de/sneak/rtnetmon.git
 cd rtnetmon
-make build
+make build   # produces ./bin/rtnetmon
 ```
 
 ## Usage
 
 ```bash
-sudo ./rtnetmon --ifaceA eth0 --labelA "Primary WAN" --ifaceB wlan0 --labelB "Backup WiFi"
+sudo ./bin/rtnetmon --ifaceA eth0 --labelA "Primary WAN" --ifaceB wlan0 --labelB "Backup WiFi"
 ```
 
 ### Command Line Options
@@ -60,41 +62,69 @@ sudo ./rtnetmon --ifaceA eth0 --labelA "Primary WAN" --ifaceB wlan0 --labelB "Ba
 
 ```
 rtnetmon/
-├── cmd/rtnetmon/       # Main entry point
+├── cmd/rtnetmon/       # main entry point (thin: calls internal/cli)
 │   └── main.go
 ├── internal/
-│   ├── cli/           # Command-line interface using Cobra
+│   ├── cli/            # command-line interface using Cobra
 │   │   └── root.go
-│   └── monitor/       # Core monitoring functionality
-│       ├── monitor.go # Main monitoring types and functions
-│       ├── loops.go   # Monitoring loops (reachability, loss, TCP)
-│       ├── styles.go  # Terminal color styles
-│       └── ui.go      # User interface rendering
-├── go.mod
-├── go.sum
-├── Makefile
+│   └── monitor/        # core monitoring functionality
+│       ├── monitor.go  # monitor types, probes, logging
+│       ├── loops.go    # monitoring loops (reachability, loss, TCP)
+│       ├── styles.go   # terminal color styles
+│       └── ui.go       # user interface rendering
+├── script/             # Scripts to Rule Them All entrypoints
+├── .gitea/workflows/   # CI (runs script/cibuild)
+├── Dockerfile          # lint + test gate phases and the build
+├── Makefile            # thin shims over script/
+├── .golangci.yml       # vendored linter config
+├── go.mod / go.sum
 └── README.md
 ```
 
 ## Development
 
-### Building
-
 ```bash
-make build          # Build the binary
-make test          # Run tests
-make lint          # Run linter
-make fmt           # Format code
-make all           # Format, lint, test, and build
+make check       # run test, lint, and fmt-check (the default target)
+make build       # build ./bin/rtnetmon
+make run         # build, then run ./bin/rtnetmon locally
+make dev         # go run ./cmd/rtnetmon
+make test        # run the test suite (test phase of the Dockerfile)
+make lint        # run golangci-lint (lint phase of the Dockerfile)
+make fmt         # format Go code (writes)
+make fmt-check   # verify formatting (read-only)
+make deps        # go mod download + go mod tidy
+make docker      # build the Docker image
+make cibuild     # bootstrap, check, and build the image (run by CI)
+make bootstrap   # install dependencies idempotently (git, make, go)
+make setup       # bootstrap plus install the git pre-commit hook
+make hooks       # install the git pre-commit hook
+make clean       # remove build artifacts
 ```
 
-### Testing
+Linting and testing run in Docker so results do not depend on host tooling;
+`make lint`, `make test`, `make docker`, and `make cibuild` therefore require
+a Docker daemon. `make check` must be green before committing, and the
+pre-commit hook (`make hooks`) runs it.
 
-The project includes unit tests for core functionality. Run tests with:
+## Entrypoints
 
-```bash
-make test
-```
+This repository adheres to the
+[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+standard: normalized scripts in `script/` are the entrypoints for the
+development workflow, and the Makefile targets are thin shims that call them.
+
+- `script/bootstrap` — install dependencies idempotently (git, make, go).
+- `script/setup` — bootstrap plus install the git pre-commit hook.
+- `script/projectname` — output the project name.
+- `script/test` — run the test suite as the Dockerfile `test` phase.
+- `script/lint` — run golangci-lint as the Dockerfile `lint` phase.
+- `script/fmt` — format Go code (host).
+- `script/fmt-check` — verify formatting (host, read-only).
+- `script/check` — run test, lint, and fmt-check.
+- `script/docker` — build the Docker image.
+- `script/cibuild` — bootstrap, check, and build the image; run by CI.
+- `script/precommit` — run by the pre-commit hook (go mod tidy check + check).
+- `script/install-precommit` — install the pre-commit hook.
 
 ### Using the Monitor API