Restore config loading, keep exported Version, keep cgo off

Bring back the in-progress viper and go-homedir configuration loading
from the original root command as a persistent pre-run on the root
command, with a --config flag and a config line in sutil info. Restore
the exported main.Version with a nolint directive instead of renaming
it. Export CGO_ENABLED=0 from the Makefile, drop -race from make test,
and remove the C toolchain from the Docker builder stage.

internal/cli/cli_test.go

@@ -3,6 +3,8 @@ package cli_test
 import (
 	"bytes"
 	"errors"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -54,6 +56,56 @@ func TestInfoCommand(t *testing.T) {
 	assert.Contains(t, output, "version: "+testVersion+"\n")
 	assert.Contains(t, output, "go: go")
 	assert.Contains(t, output, "module: sneak.berlin/go/x\n")
+	assert.Contains(t, output, "config: (none)\n")
+}
+
+func TestConfigFileDiscoveredInConfigDir(t *testing.T) {
+	t.Parallel()
+
+	configDir := t.TempDir()
+	path := filepath.Join(configDir, ".sneak.yaml")
+	require.NoError(t, os.WriteFile(path, []byte("example: 1\n"), 0o600))
+
+	params := cli.Params{Version: testVersion, ConfigDir: configDir}
+
+	output, err := executeWithParams(t, params, "", "info")
+	require.NoError(t, err)
+	assert.Contains(t, output, "Using config file: "+path+"\n")
+	assert.Contains(t, output, "config: "+path+"\n")
+}
+
+func TestConfigFlagLoadsNamedFile(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "elsewhere.yaml")
+	require.NoError(t, os.WriteFile(path, []byte("example: 1\n"), 0o600))
+
+	output, err := execute(t, "", "--config", path, "info")
+	require.NoError(t, err)
+	assert.Contains(t, output, "Using config file: "+path+"\n")
+	assert.Contains(t, output, "config: "+path+"\n")
+}
+
+func TestConfigFlagRejectsMissingFile(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "missing.yaml")
+
+	_, err := execute(t, "", "--config", path, "version")
+	require.Error(t, err)
+}
+
+func TestConfigRejectsMalformedFile(t *testing.T) {
+	t.Parallel()
+
+	configDir := t.TempDir()
+	path := filepath.Join(configDir, ".sneak.yaml")
+	require.NoError(t, os.WriteFile(path, []byte("not: [valid\n"), 0o600))
+
+	params := cli.Params{Version: testVersion, ConfigDir: configDir}
+
+	_, err := executeWithParams(t, params, "", "version")
+	require.Error(t, err)
 }
 
 func TestGenerateRandomSeededIsDeterministic(t *testing.T) {
@@ -157,12 +209,24 @@ func TestCBKDeriveRejectsInvalidMnemonic(t *testing.T) {
 	require.ErrorIs(t, err, bip39wordlist.ErrInvalidWordCount)
 }
 
-// execute runs sutil with the given stdin and arguments and returns
-// everything it wrote to stdout and stderr.
+// execute runs sutil with the given stdin and arguments, looking for config
+// in an empty temporary directory, and returns everything it wrote to
+// stdout and stderr.
 func execute(t *testing.T, stdin string, args ...string) (string, error) {
 	t.Helper()
 
-	root := cli.New(cli.Params{Version: testVersion})
+	params := cli.Params{Version: testVersion, ConfigDir: t.TempDir()}
+
+	return executeWithParams(t, params, stdin, args...)
+}
+
+// executeWithParams is execute with explicit Params.
+func executeWithParams(
+	t *testing.T, params cli.Params, stdin string, args ...string,
+) (string, error) {
+	t.Helper()
+
+	root := cli.New(params)
 
 	var output bytes.Buffer