Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Standard scaffold: script/ entrypoints with the Makefile as thin shims, a Dockerfile whose lint and test phases gate the build, a Gitea CI workflow running script/cibuild, REPO_POLICIES.md, TODO.md, .editorconfig, .dockerignore, LICENSE, wider .gitignore. .golangci.yml is byte-identical to the canonical copy in the prompts repo.

211 lint findings fixed in code: package globals became functions/fields and a cobra command constructor, magic numbers became named constants, ctx is threaded into the probes, monitor loops split. Tests moved to external _test packages with export_test.go. Behavior unchanged.

Readers will trip over: make lint/test/check now need a Docker daemon; the personal rsync copy/run targets are gone and make run runs locally.
Disclosure: four //nolint:gosec remain on the fixed-argv ping/curl calls and the operator-chosen log file, as the reference repo annotates the same class.
Disclosure: module path left as-is.

Model: opus-4-8 (implementation); fable-5-1 (merge)

TODO.md

@@ -0,0 +1,42 @@
+# Workflow
+
+One issue per unit of work, one branch and one PR per issue:
+
+- ensure a tracked issue exists with a definition of done
+- branch from `next` (never from `main`)
+- do the work; open a PR based on `next` (never on `main`)
+- pass an independent review, then the change is squash-merged into `next`
+- push; nothing stays local-only
+
+`next` is the branch for the next milestone and must stay green and
+mergeable to `main` without notice. Only `sneak` merges `next` into
+`main`, and for now only `sneak` merges into `next`. No commits land
+directly on `main` or `next` — only merges via PRs.
+
+Issue branches do NOT touch this file — it is maintained on `next`.
+Every branch editing `TODO.md` conflicts with every other.
+
+# Status
+
+The repository has been brought up to current repo standards: `script/`
+Scripts to Rule Them All entrypoints with the `Makefile` reduced to thin
+shims, a `Dockerfile` whose `lint` and `test` phases gate the build, a
+`.gitea/workflows/` CI workflow running `script/cibuild`, the vendored
+`.golangci.yml`, `REPO_POLICIES.md`, `.editorconfig`, `.dockerignore`, a
+`LICENSE` file, and a comprehensive `.gitignore`.
+
+Lint is clean under the standard `default: all` configuration, with the
+findings fixed rather than suppressed. The only annotations are
+justified `//nolint:gosec` on the `ping`/`curl` subprocess calls (G204)
+and on opening the operator-chosen log file (G304): fixed argv with no
+shell, so these are false positives, annotated as the reference repos do.
+
+# Next Step
+
+Feature work, each on its own branch and PR from `next`:
+
+- https://git.eeqj.de/sneak/rtnetmon/issues/2 — macOS support:
+  VPN-aware interface detection and a single-interface UI when only one
+  interface exists.
+- https://git.eeqj.de/sneak/rtnetmon/issues/3 — show Starlink status
+  lines when Starlink is the non-VPN gateway.