Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Add the standard scaffold and bring the tree to a clean lint under the
vendored `default: all` config. New: `script/` Scripts-to-Rule-Them-All
entrypoints with the `Makefile` reduced to thin shims; a `Dockerfile`
whose `lint` and `test` phases gate the build (final stage depends on
both); a `.gitea/workflows/` CI running `script/cibuild`; the vendored
`.golangci.yml`; `REPO_POLICIES.md`; `.editorconfig`; `.dockerignore`; a
`LICENSE` (WTFPL) and `TODO.md`; and a comprehensive `.gitignore`.

The 211 lint findings were fixed, not suppressed: package-level state
became functions/fields/a command constructor, magic numbers became named
constants, `ctx` is threaded into the probes, the loop functions were
split to cut complexity, and the deprecated `+build` tags were dropped.
Behavior is unchanged. The only annotations are justified `//nolint:gosec`
on the `ping`/`curl` subprocess calls (G204, fixed argv) and the
operator-chosen log file (G304), matching the reference repos.

`make check` is green (lint and tests run in Docker).

Model: opus-4-8

script/bootstrap

@@ -0,0 +1,70 @@
+#!/bin/sh
+# script/bootstrap: install all dependencies needed to build and develop
+# this repo, idempotently. Assumes nothing is present (not git, make, or
+# go). Base tooling comes from nix, apt, brew, or apk (detected in that
+# order; apt runs noninteractive). golangci-lint is deliberately not
+# installed: linting runs only in docker, via script/lint and the
+# Dockerfile lint phase.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+PKGMGR=""
+SUDO=""
+
+detect_pkgmgr() {
+	[ -n "$PKGMGR" ] && return 0
+	if command -v nix-env >/dev/null 2>&1; then
+		PKGMGR="nix"
+	elif command -v apt-get >/dev/null 2>&1; then
+		PKGMGR="apt"
+	elif command -v brew >/dev/null 2>&1; then
+		PKGMGR="brew"
+	elif command -v apk >/dev/null 2>&1; then
+		PKGMGR="apk"
+	else
+		echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
+		exit 1
+	fi
+	if [ "$PKGMGR" = "apt" ]; then
+		export DEBIAN_FRONTEND=noninteractive
+		if [ "$(id -u)" != "0" ]; then
+			SUDO="sudo"
+		fi
+	fi
+}
+
+# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
+pkg_install() {
+	detect_pkgmgr
+	case "$PKGMGR" in
+	nix) nix-env -iA "nixpkgs.$1" ;;
+	apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
+	brew) brew install "$3" ;;
+	apk) apk add --no-cache "$4" ;;
+	esac
+}
+
+missing() {
+	! command -v "$1" >/dev/null 2>&1
+}
+
+main() {
+	cd "$ROOT"
+
+	if missing git; then pkg_install git git git git; fi
+	if missing make; then pkg_install gnumake make make make; fi
+	if missing go; then pkg_install go golang go go; fi
+
+	# docker is platform-specific and out of scope for a package-manager
+	# bootstrap, but script/lint and script/test need it.
+	if missing docker; then
+		echo "bootstrap: docker not found; script/lint and script/test require it" >&2
+	fi
+
+	go mod download
+
+	echo "bootstrap complete"
+}
+
+main "$@"

script/check

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/check: run all checks (test, lint, fmt-check). Our extension to
+# scripts-to-rule-them-all. Must not modify any files.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+	"$SCRIPT_DIR/test"
+	"$SCRIPT_DIR/lint"
+	"$SCRIPT_DIR/fmt-check"
+}
+
+main "$@"

script/cibuild

@@ -0,0 +1,19 @@
+#!/bin/sh
+# script/cibuild: run the CI build. Runs script/bootstrap first (a pristine
+# checkout has nothing installed, and script/fmt-check runs gofmt on the
+# host), then script/check, then builds the image with --no-cache so the
+# shipped image is built from a fresh run of its own gate phases. The Gitea
+# workflow runs this on push.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+	cd "$ROOT"
+	"$SCRIPT_DIR/bootstrap"
+	"$SCRIPT_DIR/check"
+	docker build --no-cache -t "$("$SCRIPT_DIR/projectname")" .
+}
+
+main "$@"

script/docker

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/docker: build the Docker image tagged with the project name.
+# --no-cache so the lint and test gate phases actually run.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+	cd "$ROOT"
+	docker build --no-cache -t "$("$SCRIPT_DIR/projectname")" .
+}
+
+main "$@"

script/fmt

@@ -0,0 +1,16 @@
+#!/bin/sh
+# script/fmt: format all Go code (writes). Formatting is the one gate that
+# runs on the host rather than in docker.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+	cd "$ROOT"
+	gofmt -s -w .
+	if command -v goimports >/dev/null 2>&1; then
+		goimports -w .
+	fi
+}
+
+main "$@"

script/fmt-check

@@ -0,0 +1,18 @@
+#!/bin/sh
+# script/fmt-check: check Go formatting (read-only). Same scope as
+# script/fmt, but fails instead of writing.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+	cd "$ROOT"
+	out="$(gofmt -s -l .)"
+	if [ -n "$out" ]; then
+		echo "gofmt needed on:"
+		echo "$out"
+		exit 1
+	fi
+}
+
+main "$@"

script/install-precommit

@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/install-precommit: install the git pre-commit hook that runs
+# script/precommit. Our extension to scripts-to-rule-them-all.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+	cd "$ROOT"
+	printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
+	chmod +x .git/hooks/pre-commit
+	echo "pre-commit hook installed: runs script/precommit"
+}
+
+main "$@"

script/lint

@@ -0,0 +1,16 @@
+#!/bin/sh
+# script/lint: run the linter. golangci-lint is never installed on the host;
+# it runs only in docker, as the `lint` phase of the Dockerfile. --no-cache
+# forces the phase to re-execute, so a cached layer cannot report a pass it
+# did not earn. The build is tagged so no dangling image is left behind.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+	cd "$ROOT"
+	docker build --no-cache --target lint \
+		-t "$(script/projectname)-lint" .
+}
+
+main "$@"

script/precommit

@@ -0,0 +1,21 @@
+#!/bin/sh
+# script/precommit: run by the git pre-commit hook; fails the commit if
+# checks fail. Our extension to scripts-to-rule-them-all. Go repo extra:
+# `go mod tidy` must not change go.mod/go.sum.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+	cd "$ROOT"
+	go mod tidy
+	git diff --exit-code -- go.mod go.sum || {
+		echo "precommit: go mod tidy changed go.mod/go.sum;" \
+			"stage the changes and retry" >&2
+		exit 1
+	}
+	"$SCRIPT_DIR/check"
+}
+
+main "$@"

script/projectname

@@ -0,0 +1,11 @@
+#!/bin/sh
+# script/projectname: output the name of this project. Our extension to
+# scripts-to-rule-them-all. Scripts that need the name (e.g. script/docker)
+# call this so they stay identical across repos.
+set -eu
+
+main() {
+	echo "rtnetmon"
+}
+
+main "$@"

script/setup

@@ -0,0 +1,13 @@
+#!/bin/sh
+# script/setup: make a fresh clone ready for development: install
+# dependencies (script/bootstrap) and the git pre-commit hook.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+	"$SCRIPT_DIR/bootstrap"
+	"$SCRIPT_DIR/install-precommit"
+}
+
+main "$@"

script/test

@@ -0,0 +1,16 @@
+#!/bin/sh
+# script/test: run the test suite as the `test` phase of the Dockerfile,
+# with --no-cache so the tests actually re-run. The build is tagged so no
+# dangling image is left behind. The 90s per-package timeout matches the
+# org-wide backstop in REPO_POLICIES.md.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+	cd "$ROOT"
+	docker build --no-cache --target test \
+		-t "$(script/projectname)-test" .
+}
+
+main "$@"