Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Add the standard scaffold and bring the tree to a clean lint under the
vendored `default: all` config. New: `script/` Scripts-to-Rule-Them-All
entrypoints with the `Makefile` reduced to thin shims; a `Dockerfile`
whose `lint` and `test` phases gate the build (final stage depends on
both); a `.gitea/workflows/` CI running `script/cibuild`; the vendored
`.golangci.yml`; `REPO_POLICIES.md`; `.editorconfig`; `.dockerignore`; a
`LICENSE` (WTFPL) and `TODO.md`; and a comprehensive `.gitignore`.

The 211 lint findings were fixed, not suppressed: package-level state
became functions/fields/a command constructor, magic numbers became named
constants, `ctx` is threaded into the probes, the loop functions were
split to cut complexity, and the deprecated `+build` tags were dropped.
Behavior is unchanged. The only annotations are justified `//nolint:gosec`
on the `ping`/`curl` subprocess calls (G204, fixed argv) and the
operator-chosen log file (G304), matching the reference repos.

`make check` is green (lint and tests run in Docker).

Model: opus-4-8

README.md

@@ -84,20 +84,15 @@ rtnetmon/
 ## Development
 
 ```bash
-make check       # run test, lint, and fmt-check (the default target)
 make build       # build ./bin/rtnetmon
-make run         # build, then run ./bin/rtnetmon locally
+make check       # run tests, lint, and fmt-check (the default target)
-make dev         # go run ./cmd/rtnetmon
 make test        # run the test suite (test phase of the Dockerfile)
 make lint        # run golangci-lint (lint phase of the Dockerfile)
 make fmt         # format Go code (writes)
 make fmt-check   # verify formatting (read-only)
-make deps        # go mod download + go mod tidy
 make docker      # build the Docker image
-make cibuild     # bootstrap, check, and build the image (run by CI)
-make bootstrap   # install dependencies idempotently (git, make, go)
-make setup       # bootstrap plus install the git pre-commit hook
 make hooks       # install the git pre-commit hook
+make dev         # go run ./cmd/rtnetmon
 make clean       # remove build artifacts
 ```
 

internal/monitor/monitor.go

@@ -57,7 +57,7 @@ const (
 	ipInfoTimeout    = 2 * time.Second
 	lossQueryTimeout = 3 * time.Second
 	uiUpdateBuffer   = 100
-	logFileMode      = 0o644
+	logFileMode      = 0o600
 )
 
 // errNoIPv4 is returned when an interface has no usable IPv4 address.