Rewrite Makefile with required policy targets

test/lint/fmt/fmt-check/check/docker/hooks plus build, all, and clean.
make check no longer builds the binary (it must not modify files); the
test target uses the 30s-timeout conditional -v rerun pattern. Version
is injected via -ldflags and exposed as sfdupes --version.

main.go

@@ -27,11 +27,18 @@ const (
 	exitUsage = 2
 )
 
+// Version is the build version, injected at link time via -ldflags
+// (see the Makefile); "dev" for a plain go build.
+//
+//nolint:gochecknoglobals // written only by the linker
+var Version = "dev"
+
 func main() {
 	root := &cobra.Command{
-		Use:   "sfdupes",
-		Short: "Find candidate duplicate files by size and head/tail SHA-256",
-		Args:  cobra.NoArgs,
+		Use:     "sfdupes",
+		Short:   "Find candidate duplicate files by size and head/tail SHA-256",
+		Version: Version,
+		Args:    cobra.NoArgs,
 		Run: func(cmd *cobra.Command, _ []string) {
 			// A missing subcommand prints usage and exits 2.
 			_ = cmd.Usage()