p0: skeleton, dialer-Control URL guard, flake, Makefile

Go service with /healthz, SSRF guard (parse + resolve-all + Control),
exhaustive tests, NixOS module, and Makefile as source of truth for
build flags. nix flake check runs make test lint.

Makefile

@@ -0,0 +1,43 @@
+# Makefile is the source of truth for build flags. The flake's buildGoModule
+# uses the same -trimpath / ldflags, and `nix flake check` runs `make test lint`.
+
+PREFIX     ?= /usr/local
+DESTDIR    ?=
+VERSION    ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+LDFLAGS    := -s -w -X main.version=$(VERSION)
+CGO_ENABLED ?= 0
+
+GO         ?= go
+STATICCHECK ?= $(shell command -v staticcheck 2>/dev/null)
+
+.PHONY: all build test lint contract install clean
+
+all: build
+
+build:
+	CGO_ENABLED=$(CGO_ENABLED) $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o bin/sift ./cmd/sift
+
+test:
+	$(GO) test -race ./...
+
+lint:
+	$(GO) vet ./...
+	@if [ -n "$(STATICCHECK)" ]; then $(STATICCHECK) ./...; else echo "staticcheck not found; skipped"; fi
+
+# Hermes 0.19/0.21 parser harness lands in P1.
+contract:
+	@echo "P0: no contract tests yet"
+
+install: build
+	install -d $(DESTDIR)$(PREFIX)/bin
+	install -m 755 bin/sift $(DESTDIR)$(PREFIX)/bin/sift
+	install -d $(DESTDIR)/etc/sift
+	if [ ! -f $(DESTDIR)/etc/sift/config.toml ]; then \
+		install -m 644 dist/sift.toml.example $(DESTDIR)/etc/sift/config.toml; \
+	fi
+	install -d $(DESTDIR)$(PREFIX)/lib/systemd/system
+	install -m 644 dist/sift.service $(DESTDIR)$(PREFIX)/lib/systemd/system/sift.service
+
+clean:
+	rm -rf bin/
+	rm -f sift *.test