Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Add the standard scaffold and bring the tree to a clean lint under the
vendored `default: all` config. New: `script/` Scripts-to-Rule-Them-All
entrypoints with the `Makefile` reduced to thin shims; a `Dockerfile`
whose `lint` and `test` phases gate the build (final stage depends on
both); a `.gitea/workflows/` CI running `script/cibuild`; the vendored
`.golangci.yml`; `REPO_POLICIES.md`; `.editorconfig`; `.dockerignore`; a
`LICENSE` (WTFPL) and `TODO.md`; and a comprehensive `.gitignore`.

The 211 lint findings were fixed, not suppressed: package-level state
became functions/fields/a command constructor, magic numbers became named
constants, `ctx` is threaded into the probes, the loop functions were
split to cut complexity, and the deprecated `+build` tags were dropped.
Behavior is unchanged. The only annotations are justified `//nolint:gosec`
on the `ping`/`curl` subprocess calls (G204, fixed argv) and the
operator-chosen log file (G304), matching the reference repos.

`make check` is green (lint and tests run in Docker).

Model: opus-4-8

internal/cli/root.go

@@ -1,6 +1,6 @@
 //go:build linux
-// +build linux
 
+// Package cli wires command-line flags to the network monitor and runs it.
 package cli
 
 import (
@@ -15,8 +15,8 @@ import (
 	"git.eeqj.de/sneak/rtnetmon/internal/monitor"
 )
 
-// Config holds the application configuration
-type Config struct {
+// config holds the application configuration.
+type config struct {
 	IfaceA  string
 	LabelA  string
 	IfaceB  string
@@ -25,94 +25,104 @@ type Config struct {
 	LogFile string
 }
 
-var (
-	cfg     Config
-	rootCmd = &cobra.Command{
-		Use:   "rtnetmon",
-		Short: "Real-time network monitoring dashboard",
-		Long: `rtnetmon is a dual-interface network monitoring dashboard that provides
-real-time visibility into network health, packet loss, and latency.`,
-		RunE: runMonitor,
-	}
-)
-
-// Default hosts for monitoring
-var (
-	defaultReachabilityHosts = []string{
+// defaultReachabilityHosts is the default reachability host list.
+func defaultReachabilityHosts() []string {
+	return []string{
 		"8.8.8.8", "8.8.4.4", "google.com", "github.com",
 		"console.aws.amazon.com", "console.cloud.google.com",
 		"fast.com", "datavi.be", "captive.apple.com",
 	}
+}
 
-	defaultPacketLossHosts = []string{
-		"github.com", "google.com", "8.8.8.8", "captive.apple.com", "62.115.190.68",
+// defaultPacketLossHosts is the default packet-loss host list.
+func defaultPacketLossHosts() []string {
+	return []string{
+		"github.com", "google.com", "8.8.8.8",
+		"captive.apple.com", "62.115.190.68",
 	}
+}
 
-	defaultTCPHosts = []string{
+// defaultTCPHosts is the default TCP connect host:port list.
+func defaultTCPHosts() []string {
+	return []string{
 		"datavi.be:443", "fast.com:443",
 		"console.aws.amazon.com:443", "console.cloud.google.com:443",
 		"captive.apple.com:80", "google.com:443",
 	}
-)
-
-func init() {
-	// Define flags
-	rootCmd.Flags().StringVar(&cfg.IfaceA, "ifaceA", "gu0", "primary network interface")
-	rootCmd.Flags().StringVar(&cfg.LabelA, "labelA", "gu LAN - VPN outbound", "label for ifaceA")
-	rootCmd.Flags().StringVar(&cfg.IfaceB, "ifaceB", "backhaul0", "secondary network interface")
-	rootCmd.Flags().StringVar(&cfg.LabelB, "labelB", "Cox cable direct", "label for ifaceB")
-	rootCmd.Flags().StringSliceVar(&cfg.Hosts, "hosts", defaultReachabilityHosts, "comma-separated reachability hosts")
-	rootCmd.Flags().StringVar(&cfg.LogFile, "logfile", "/tmp/rtnetmon.log", "path to log file")
-
-	// Bind flags to viper
-	_ = viper.BindPFlag("ifaceA", rootCmd.Flags().Lookup("ifaceA"))
-	_ = viper.BindPFlag("labelA", rootCmd.Flags().Lookup("labelA"))
-	_ = viper.BindPFlag("ifaceB", rootCmd.Flags().Lookup("ifaceB"))
-	_ = viper.BindPFlag("labelB", rootCmd.Flags().Lookup("labelB"))
-	_ = viper.BindPFlag("hosts", rootCmd.Flags().Lookup("hosts"))
-	_ = viper.BindPFlag("logfile", rootCmd.Flags().Lookup("logfile"))
 }
 
-func runMonitor(cmd *cobra.Command, args []string) error {
+// newRootCmd builds the cobra root command with its flags bound.
+func newRootCmd() *cobra.Command {
+	cfg := &config{}
+	cmd := &cobra.Command{
+		Use:   "rtnetmon",
+		Short: "Real-time network monitoring dashboard",
+		Long: `rtnetmon is a dual-interface network monitoring dashboard that provides
+real-time visibility into network health, packet loss, and latency.`,
+		RunE: func(_ *cobra.Command, _ []string) error {
+			return runMonitor(cfg)
+		},
+	}
+	registerFlags(cmd, cfg)
+
+	return cmd
+}
+
+// registerFlags defines and viper-binds the command's flags.
+func registerFlags(cmd *cobra.Command, cfg *config) {
+	f := cmd.Flags()
+	f.StringVar(&cfg.IfaceA, "ifaceA", "gu0", "primary network interface")
+	f.StringVar(&cfg.LabelA, "labelA", "gu LAN - VPN outbound", "label for ifaceA")
+	f.StringVar(&cfg.IfaceB, "ifaceB", "backhaul0", "secondary network interface")
+	f.StringVar(&cfg.LabelB, "labelB", "Cox cable direct", "label for ifaceB")
+	f.StringSliceVar(&cfg.Hosts, "hosts", defaultReachabilityHosts(),
+		"comma-separated reachability hosts")
+	f.StringVar(&cfg.LogFile, "logfile", "/tmp/rtnetmon.log", "path to log file")
+
+	for _, name := range []string{
+		"ifaceA", "labelA", "ifaceB", "labelB", "hosts", "logfile",
+	} {
+		_ = viper.BindPFlag(name, f.Lookup(name))
+	}
+}
+
+// runMonitor constructs and runs the monitor from cfg.
+func runMonitor(cfg *config) error {
 	monitor.Logf(cfg.LogFile, "Starting rtnetmon")
-	monitor.Logf(cfg.LogFile, "Monitoring interfaces %s and %s", cfg.IfaceA, cfg.IfaceB)
+	monitor.Logf(cfg.LogFile, "Monitoring interfaces %s and %s",
+		cfg.IfaceA, cfg.IfaceB)
 
-	// Create the monitor
-	mon := monitor.NewMonitor(cfg.IfaceA, cfg.LabelA, cfg.IfaceB, cfg.LabelB, cfg.LogFile)
+	mon := monitor.NewMonitor(cfg.IfaceA, cfg.LabelA, cfg.IfaceB, cfg.LabelB,
+		cfg.LogFile)
 
-	// Add reachability hosts
 	for _, host := range cfg.Hosts {
 		mon.AddReachabilityHost(host)
 	}
 
-	// Add packet loss hosts
-	for _, host := range defaultPacketLossHosts {
+	for _, host := range defaultPacketLossHosts() {
 		mon.AddPacketLossHost(host)
 	}
 
-	// Add TCP hosts
-	for _, host := range defaultTCPHosts {
+	for _, host := range defaultTCPHosts() {
 		mon.AddTCPHost(host)
 	}
 
-	// Create context with signal handling
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	// Handle signals
 	sig := make(chan os.Signal, 1)
 	signal.Notify(sig, os.Interrupt, syscall.SIGTERM)
+
 	go func() {
 		s := <-sig
 		monitor.Logf(cfg.LogFile, "Signal received: %v", s)
 		cancel()
 	}()
 
-	// Run the monitor
 	return mon.Run(ctx)
 }
 
-// Execute runs the root command
+// Execute builds the root command and runs it.
 func Execute() error {
-	return rootCmd.Execute()
+	return newRootCmd().Execute()
 }