Gate prune's local-cleanup output on --json, and make make build build (closes #108)

Closes #110.

CleanupLocalSnapshots wrote three prose lines to stdout with no --json
awareness, covering every branch, so `vaultik prune --json | jq` failed
on any input. -q never helped either: printlnStdout and stdoutf write
straight to v.Stdout and never consult v.UI, which is what SetQuiet
affects. It now takes *PruneOptions, symmetric with its sibling phase
PruneBlobs, and gates all three writes.

Threading opts.JSON was chosen over moving the lines to log.Info,
because internal/log/log.go defaults the level to Warn: log.Info would
not have relocated them to stderr, it would have deleted them from a
plain `vaultik prune`, and "Removing stale local record" narrates the
deletion of local index rows. The stale-record count is deliberately not
added to PruneBlobsResult - every field there is blob-scoped and produced
by the phase that runs after this reconciliation, so adding it would
change a published --json schema as a side effect of a stream fix.

Note for anyone reading the --json contract: under --json the
stale-record removal now produces no signal in either stream. stdout is
correctly gated, stderr is level-pinned to Warn because --json sets
Quiet, and the count is not in the document. That is inherited behaviour
- PruneBlobs' own log.Info calls are equally invisible under --json - not
something this change introduced, and it is tracked separately.

make build exited 0 and produced nothing: .PHONY listed build with no
build: rule, and a phony target with no prerequisites and no recipe is
considered already satisfied, which turns what would be a hard error into
a silent success. In a repo where `make build` is the documented way to
build, a caller checking the exit code concluded the build worked. Now
`build: vaultik`, verified in both directions - a clean build produces
the binary, a deliberately broken one exits non-zero and produces none.

All 19 .PHONY names were audited; build was the only one lacking a rule.
TestPhonyTargetsAllHaveRules keeps that true for names added later, so
the class is closed rather than the instance.

internal/cli/entry_banner_test.go

@@ -28,8 +28,13 @@ const (
 	cmdRemote   = "remote"
 	cmdInfo     = "info"
 
-	flagJSON  = "--json"
-	flagQuiet = "--quiet"
+	flagJSON   = "--json"
+	flagQuiet  = "--quiet"
+	flagConfig = "--config"
+
+	// programName is argv[0] as the real process receives it. Entry
+	// strips it before scanning, so it has to be present.
+	programName = "vaultik"
 
 	// someSnapshotID is any snapshot identifier: these tests never run
 	// the command, so it only has to occupy the positional argument.
@@ -65,7 +70,7 @@ var jsonArgumentVectors = map[string][]string{
 	// A --json invocation that also carries a flag with a value, so the
 	// scan cannot be fooled by an argument that consumes the next one.
 	"json with config": {
-		"--config", "/nonexistent/vaultik.yml", cmdSnapshot, cmdList, flagJSON,
+		flagConfig, "/nonexistent/vaultik.yml", cmdSnapshot, cmdList, flagJSON,
 	},
 }
 
@@ -222,7 +227,7 @@ func TestEntryJSONStdoutIsExactlyOneDocument(t *testing.T) {
 	})
 
 	os.Args = []string{
-		"vaultik", "--config", configPath, cmdSnapshot, cmdList, flagJSON,
+		programName, flagConfig, configPath, cmdSnapshot, cmdList, flagJSON,
 	}
 
 	stdout := captureProcessStdout(t, Entry)