Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Add the standard scaffold and bring the tree to a clean lint under the
vendored `default: all` config. New: `script/` Scripts-to-Rule-Them-All
entrypoints with the `Makefile` reduced to thin shims; a `Dockerfile`
whose `lint` and `test` phases gate the build (final stage depends on
both); a `.gitea/workflows/` CI running `script/cibuild`; the vendored
`.golangci.yml`; `REPO_POLICIES.md`; `.editorconfig`; `.dockerignore`; a
`LICENSE` (WTFPL) and `TODO.md`; and a comprehensive `.gitignore`.

The 211 lint findings were fixed, not suppressed: package-level state
became functions/fields/a command constructor, magic numbers became named
constants, `ctx` is threaded into the probes, the loop functions were
split to cut complexity, and the deprecated `+build` tags were dropped.
Behavior is unchanged. The only annotations are justified `//nolint:gosec`
on the `ping`/`curl` subprocess calls (G204, fixed argv) and the
operator-chosen log file (G304), matching the reference repos.

`make check` is green (lint and tests run in Docker).

Model: opus-4-8

internal/monitor/export_test.go

@@ -0,0 +1,20 @@
+//go:build linux
+
+package monitor
+
+// Test-only accessors exposing unexported state for white-box assertions.
+
+// ReachabilityHosts returns the configured reachability hosts.
+func (m *Monitor) ReachabilityHosts() []string { return m.reachabilityHosts }
+
+// PacketLossHosts returns the configured packet-loss hosts.
+func (m *Monitor) PacketLossHosts() []string { return m.packetLossHosts }
+
+// TCPHosts returns the configured TCP hosts.
+func (m *Monitor) TCPHosts() []string { return m.tcpHosts }
+
+// InterfaceA returns the first monitored interface.
+func (m *Monitor) InterfaceA() *InterfaceStatus { return m.interfaceA }
+
+// InterfaceB returns the second monitored interface.
+func (m *Monitor) InterfaceB() *InterfaceStatus { return m.interfaceB }