Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Add the standard scaffold and bring the tree to a clean lint under the
vendored `default: all` config. New: `script/` Scripts-to-Rule-Them-All
entrypoints with the `Makefile` reduced to thin shims; a `Dockerfile`
whose `lint` and `test` phases gate the build (final stage depends on
both); a `.gitea/workflows/` CI running `script/cibuild`; the vendored
`.golangci.yml`; `REPO_POLICIES.md`; `.editorconfig`; `.dockerignore`; a
`LICENSE` (WTFPL) and `TODO.md`; and a comprehensive `.gitignore`.

The 211 lint findings were fixed, not suppressed: package-level state
became functions/fields/a command constructor, magic numbers became named
constants, `ctx` is threaded into the probes, the loop functions were
split to cut complexity, and the deprecated `+build` tags were dropped.
Behavior is unchanged. The only annotations are justified `//nolint:gosec`
on the `ping`/`curl` subprocess calls (G204, fixed argv) and the
operator-chosen log file (G304), matching the reference repos.

`make check` is green (lint and tests run in Docker).

Model: opus-4-8

script/precommit

@@ -0,0 +1,21 @@
+#!/bin/sh
+# script/precommit: run by the git pre-commit hook; fails the commit if
+# checks fail. Our extension to scripts-to-rule-them-all. Go repo extra:
+# `go mod tidy` must not change go.mod/go.sum.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+	cd "$ROOT"
+	go mod tidy
+	git diff --exit-code -- go.mod go.sum || {
+		echo "precommit: go mod tidy changed go.mod/go.sum;" \
+			"stage the changes and retry" >&2
+		exit 1
+	}
+	"$SCRIPT_DIR/check"
+}
+
+main "$@"