Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Standard scaffold: script/ entrypoints with the Makefile as thin shims, a Dockerfile whose lint and test phases gate the build, a Gitea CI workflow running script/cibuild, REPO_POLICIES.md, TODO.md, .editorconfig, .dockerignore, LICENSE, wider .gitignore. .golangci.yml is byte-identical to the canonical copy in the prompts repo.

211 lint findings fixed in code: package globals became functions/fields and a cobra command constructor, magic numbers became named constants, ctx is threaded into the probes, monitor loops split. Tests moved to external _test packages with export_test.go. Behavior unchanged.

Readers will trip over: make lint/test/check now need a Docker daemon; the personal rsync copy/run targets are gone and make run runs locally.
Disclosure: four //nolint:gosec remain on the fixed-argv ping/curl calls and the operator-chosen log file, as the reference repo annotates the same class.
Disclosure: module path left as-is.

Model: opus-4-8 (implementation); fable-5-1 (merge)

Makefile

@@ -1,40 +1,52 @@
-.PHONY: test lint fmt build run-local clean all copy run
+.PHONY: bootstrap setup test lint fmt fmt-check check build run dev deps \
+	docker cibuild clean hooks
 
-# Default target
-default: test
+# Target bodies live in script/ (Scripts to Rule Them All); the targets
+# below are thin shims that call them.
+.DEFAULT_GOAL := check
 
-# Build the binary
-build:
-	go build -o rtnetmon ./cmd/rtnetmon
+bootstrap:
+	@script/bootstrap
 
-# Run tests
-test: lint
-	go test -v ./...
+setup:
+	@script/setup
+
+test:
+	@script/test
 
-# Run linter
 lint:
-	golangci-lint run --config .golangci.yml ./...
+	@script/lint
 
-# Format code
 fmt:
-	go fmt ./...
+	@script/fmt
 
-# Run the application locally
-run-local: build
-	./rtnetmon
+fmt-check:
+	@script/fmt-check
+
+check:
+	@script/check
+
+docker:
+	@script/docker
+
+cibuild:
+	@script/cibuild
+
+hooks:
+	@script/install-precommit
+
+build:
+	CGO_ENABLED=0 go build -trimpath -o bin/rtnetmon ./cmd/rtnetmon
+
+run: build
+	./bin/rtnetmon
+
+dev:
+	go run ./cmd/rtnetmon
+
+deps:
+	go mod download
+	go mod tidy
 
-# Clean build artifacts
 clean:
-	rm -f rtnetmon
-	rm -f main.go.old
-
-# Build and test everything
-all: fmt lint test build
-
-# Remote deployment targets
-copy:
-	ssh root@las1stor1 -v "mkdir -p /tmp/x"
-	rsync -av --exclude='.git' --exclude='*.test' --exclude='/rtnetmon' --exclude='main.go.old' ./ root@las1stor1:/tmp/x/
-
-run: copy
-	ssh -t root@las1stor1 -v "cd /tmp/x && go run ./cmd/rtnetmon"
+	rm -rf bin/