Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Add the standard scaffold and bring the tree to a clean lint under the
vendored `default: all` config: `script/` Scripts-to-Rule-Them-All
entrypoints with the `Makefile` as thin shims; a `Dockerfile` whose
`lint` and `test` phases gate the build; `.gitea/workflows/` CI running
`script/cibuild`; `REPO_POLICIES.md`, `.editorconfig`, `.dockerignore`,
`LICENSE` (WTFPL), `TODO.md`, `.gitignore`. The `.golangci.yml` is
byte-identical to the canonical copy in the `prompts` repo
(`https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`).

The 211 lint findings were fixed, not suppressed: package globals became
functions/fields/a command constructor, magic numbers became named
constants, `ctx` threads into the probes, loop functions were split to
cut complexity. Behavior is unchanged; the log file mode stays `0644`.
Four `//nolint:gosec` remain — G204 on the fixed-argv subprocess calls,
G304 on the operator-chosen log file — matching the reference repos.

`make check` is green (lint and tests run in Docker).

Model: opus-4-8

script/bootstrap

@@ -0,0 +1,70 @@
+#!/bin/sh
+# script/bootstrap: install all dependencies needed to build and develop
+# this repo, idempotently. Assumes nothing is present (not git, make, or
+# go). Base tooling comes from nix, apt, brew, or apk (detected in that
+# order; apt runs noninteractive). golangci-lint is deliberately not
+# installed: linting runs only in docker, via script/lint and the
+# Dockerfile lint phase.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+PKGMGR=""
+SUDO=""
+
+detect_pkgmgr() {
+	[ -n "$PKGMGR" ] && return 0
+	if command -v nix-env >/dev/null 2>&1; then
+		PKGMGR="nix"
+	elif command -v apt-get >/dev/null 2>&1; then
+		PKGMGR="apt"
+	elif command -v brew >/dev/null 2>&1; then
+		PKGMGR="brew"
+	elif command -v apk >/dev/null 2>&1; then
+		PKGMGR="apk"
+	else
+		echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
+		exit 1
+	fi
+	if [ "$PKGMGR" = "apt" ]; then
+		export DEBIAN_FRONTEND=noninteractive
+		if [ "$(id -u)" != "0" ]; then
+			SUDO="sudo"
+		fi
+	fi
+}
+
+# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
+pkg_install() {
+	detect_pkgmgr
+	case "$PKGMGR" in
+	nix) nix-env -iA "nixpkgs.$1" ;;
+	apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
+	brew) brew install "$3" ;;
+	apk) apk add --no-cache "$4" ;;
+	esac
+}
+
+missing() {
+	! command -v "$1" >/dev/null 2>&1
+}
+
+main() {
+	cd "$ROOT"
+
+	if missing git; then pkg_install git git git git; fi
+	if missing make; then pkg_install gnumake make make make; fi
+	if missing go; then pkg_install go golang go go; fi
+
+	# docker is platform-specific and out of scope for a package-manager
+	# bootstrap, but script/lint and script/test need it.
+	if missing docker; then
+		echo "bootstrap: docker not found; script/lint and script/test require it" >&2
+	fi
+
+	go mod download
+
+	echo "bootstrap complete"
+}
+
+main "$@"