Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Standard scaffold: script/ entrypoints with the Makefile as thin shims, a Dockerfile whose lint and test phases gate the build, a Gitea CI workflow running script/cibuild, REPO_POLICIES.md, TODO.md, .editorconfig, .dockerignore, LICENSE, wider .gitignore. .golangci.yml is byte-identical to the canonical copy in the prompts repo.

211 lint findings fixed in code: package globals became functions/fields and a cobra command constructor, magic numbers became named constants, ctx is threaded into the probes, monitor loops split. Tests moved to external _test packages with export_test.go. Behavior unchanged.

Readers will trip over: make lint/test/check now need a Docker daemon; the personal rsync copy/run targets are gone and make run runs locally.
Disclosure: four //nolint:gosec remain on the fixed-argv ping/curl calls and the operator-chosen log file, as the reference repo annotates the same class.
Disclosure: module path left as-is.

Model: opus-4-8 (implementation); fable-5-1 (merge)

script/cibuild

@@ -0,0 +1,19 @@
+#!/bin/sh
+# script/cibuild: run the CI build. Runs script/bootstrap first (a pristine
+# checkout has nothing installed, and script/fmt-check runs gofmt on the
+# host), then script/check, then builds the image with --no-cache so the
+# shipped image is built from a fresh run of its own gate phases. The Gitea
+# workflow runs this on push.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+	cd "$ROOT"
+	"$SCRIPT_DIR/bootstrap"
+	"$SCRIPT_DIR/check"
+	docker build --no-cache -t "$("$SCRIPT_DIR/projectname")" .
+}
+
+main "$@"