Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Add the standard scaffold and bring the tree to a clean lint under the
vendored `default: all` config. New: `script/` Scripts-to-Rule-Them-All
entrypoints with the `Makefile` reduced to thin shims; a `Dockerfile`
whose `lint` and `test` phases gate the build (final stage depends on
both); a `.gitea/workflows/` CI running `script/cibuild`; the vendored
`.golangci.yml`; `REPO_POLICIES.md`; `.editorconfig`; `.dockerignore`; a
`LICENSE` (WTFPL) and `TODO.md`; and a comprehensive `.gitignore`.

The 211 lint findings were fixed, not suppressed: package-level state
became functions/fields/a command constructor, magic numbers became named
constants, `ctx` is threaded into the probes, the loop functions were
split to cut complexity, and the deprecated `+build` tags were dropped.
Behavior is unchanged. The only annotations are justified `//nolint:gosec`
on the `ping`/`curl` subprocess calls (G204, fixed argv) and the
operator-chosen log file (G304), matching the reference repos.

`make check` is green (lint and tests run in Docker).

Model: opus-4-8

Dockerfile

@@ -0,0 +1,37 @@
+# Lint phase. golangci-lint runs here, in the pinned linter image, never on
+# the host. script/lint builds this stage by name with --no-cache.
+# golangci/golangci-lint:v2.12.2, 2026-05-06
+FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN golangci-lint config verify --config .golangci.yml
+RUN golangci-lint run --config .golangci.yml ./...
+
+# Test phase. script/test builds this stage by name with --no-cache.
+# golang:1.26.1-bookworm, 2026-03-17
+FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS test
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN go test -count=1 -race -cover -timeout 90s ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -count=1 -race -v -timeout 90s ./...; exit 1; }
+
+# Build stage, and the last one. Nothing is wanted from the phases above;
+# the two copies are the ordering edges that make BuildKit build them first,
+# so this stage cannot build unless lint and test passed. For this
+# non-server tool the final stage is the build/development environment
+# carrying the compiled binary; rtnetmon runs on a host with the privileges
+# to open raw ICMP sockets, not as a container service.
+# golang:1.26.1-bookworm, 2026-03-17
+FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS builder
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -trimpath -o /rtnetmon ./cmd/rtnetmon/