Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Add the standard scaffold and bring the tree to a clean lint under the
vendored `default: all` config: `script/` Scripts-to-Rule-Them-All
entrypoints with the `Makefile` as thin shims; a `Dockerfile` whose
`lint` and `test` phases gate the build; `.gitea/workflows/` CI running
`script/cibuild`; `REPO_POLICIES.md`, `.editorconfig`, `.dockerignore`,
`LICENSE` (WTFPL), `TODO.md`, `.gitignore`. The `.golangci.yml` is
byte-identical to the canonical copy in the `prompts` repo
(`https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`).

The 211 lint findings were fixed, not suppressed: package globals became
functions/fields/a command constructor, magic numbers became named
constants, `ctx` threads into the probes, loop functions were split to
cut complexity. Behavior is unchanged; the log file mode stays `0644`.
Four `//nolint:gosec` remain — G204 on the fixed-argv subprocess calls,
G304 on the operator-chosen log file — matching the reference repos.

`make check` is green (lint and tests run in Docker).

Model: opus-4-8

script/cibuild

@@ -0,0 +1,19 @@
+#!/bin/sh
+# script/cibuild: run the CI build. Runs script/bootstrap first (a pristine
+# checkout has nothing installed, and script/fmt-check runs gofmt on the
+# host), then script/check, then builds the image with --no-cache so the
+# shipped image is built from a fresh run of its own gate phases. The Gitea
+# workflow runs this on push.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+	cd "$ROOT"
+	"$SCRIPT_DIR/bootstrap"
+	"$SCRIPT_DIR/check"
+	docker build --no-cache -t "$("$SCRIPT_DIR/projectname")" .
+}
+
+main "$@"