Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Add the standard scaffold and bring the tree to a clean lint under the
vendored `default: all` config: `script/` Scripts-to-Rule-Them-All
entrypoints with the `Makefile` as thin shims; a `Dockerfile` whose
`lint` and `test` phases gate the build; `.gitea/workflows/` CI running
`script/cibuild`; `REPO_POLICIES.md`, `.editorconfig`, `.dockerignore`,
`LICENSE` (WTFPL), `TODO.md`, `.gitignore`. The `.golangci.yml` is
byte-identical to the canonical copy in the `prompts` repo
(`https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`).

The 211 lint findings were fixed, not suppressed: package globals became
functions/fields/a command constructor, magic numbers became named
constants, `ctx` threads into the probes, loop functions were split to
cut complexity. Behavior is unchanged; the log file mode stays `0644`.
Four `//nolint:gosec` remain — G204 on the fixed-argv subprocess calls,
G304 on the operator-chosen log file — matching the reference repos.

`make check` is green (lint and tests run in Docker).

Model: opus-4-8

internal/cli/root_test.go

@@ -1,36 +1,25 @@
 //go:build linux
-// +build linux
 
-package cli
+package cli_test
 
 import (
 	"testing"
+
+	"git.eeqj.de/sneak/rtnetmon/internal/cli"
 )
 
-// TestExecute tests that the CLI can be initialized
-func TestExecute(t *testing.T) {
-	// This is a simple compilation test to ensure the CLI package compiles
-	// We can't easily test the full Execute() function as it starts the UI
+func TestNewRootCmd(t *testing.T) {
+	t.Parallel()
 
-	// Test that rootCmd is properly initialized
-	if rootCmd == nil {
-		t.Fatal("rootCmd is nil")
+	cmd := cli.NewRootCmd()
+	if cmd.Use != "rtnetmon" {
+		t.Errorf("Use = %q, want %q", cmd.Use, "rtnetmon")
 	}
 
-	if rootCmd.Use != "rtnetmon" {
-		t.Errorf("Expected rootCmd.Use to be 'rtnetmon', got '%s'", rootCmd.Use)
-	}
-
-	// Test that default configuration is set
-	if len(defaultReachabilityHosts) == 0 {
-		t.Error("defaultReachabilityHosts is empty")
-	}
-
-	if len(defaultPacketLossHosts) == 0 {
-		t.Error("defaultPacketLossHosts is empty")
-	}
-
-	if len(defaultTCPHosts) == 0 {
-		t.Error("defaultTCPHosts is empty")
+	names := []string{"ifaceA", "labelA", "ifaceB", "labelB", "hosts", "logfile"}
+	for _, name := range names {
+		if cmd.Flags().Lookup(name) == nil {
+			t.Errorf("flag %q not registered", name)
+		}
 	}
 }