Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Standard scaffold: script/ entrypoints with the Makefile as thin shims, a Dockerfile whose lint and test phases gate the build, a Gitea CI workflow running script/cibuild, REPO_POLICIES.md, TODO.md, .editorconfig, .dockerignore, LICENSE, wider .gitignore. .golangci.yml is byte-identical to the canonical copy in the prompts repo.

211 lint findings fixed in code: package globals became functions/fields and a cobra command constructor, magic numbers became named constants, ctx is threaded into the probes, monitor loops split. Tests moved to external _test packages with export_test.go. Behavior unchanged.

Readers will trip over: make lint/test/check now need a Docker daemon; the personal rsync copy/run targets are gone and make run runs locally.
Disclosure: four //nolint:gosec remain on the fixed-argv ping/curl calls and the operator-chosen log file, as the reference repo annotates the same class.
Disclosure: module path left as-is.

Model: opus-4-8 (implementation); fable-5-1 (merge)

cmd/rtnetmon/main.go

@@ -1,20 +1,18 @@
 //go:build linux
-// +build linux
 
-// netmon – dual-interface network dashboard (curses)
-// WTFPL – 2025-05-16  sneak@sneak.berlin
+// Command rtnetmon is a dual-interface real-time network monitoring
+// dashboard for Linux. WTFPL, sneak@sneak.berlin.
 package main
 
 import (
 	"log"
-	"os"
 
 	"git.eeqj.de/sneak/rtnetmon/internal/cli"
 )
 
 func main() {
-	if err := cli.Execute(); err != nil {
+	err := cli.Execute()
+	if err != nil {
 		log.Fatal(err)
-		os.Exit(1)
 	}
 }