p0: skeleton, dialer-Control URL guard, flake, Makefile

Go service with /healthz, SSRF guard (parse + resolve-all + Control),
exhaustive tests, NixOS module, and Makefile as source of truth for
build flags. nix flake check runs make test lint.

README.md

@@ -4,4 +4,19 @@ LLM-oriented fetch and search for the Hermes fleet: fetch a resource and get it
 compact, and with useful context attached — using local models (Dixie), SearXNG and Brave on
 orion, and Honcho for retrieval.
 
-Status: planning. See [`docs/PLAN.md`](docs/PLAN.md).
+Status: P0 skeleton (guard, `/healthz`, flake, NixOS module, Makefile). See [`docs/PLAN.md`](docs/PLAN.md).
+
+## Build
+
+Makefile is the source of truth for flags (`CGO_ENABLED=0`, `-trimpath`, `-s -w -X main.version=`).
+
+```
+make build          # bin/sift
+make test           # go test -race ./...
+make lint           # go vet, and staticcheck if installed
+make install        # PREFIX=/usr/local; example config in /etc/sift/
+nix build           # packages.sift, same ldflags
+nix flake check     # make test lint
+```
+
+The service does not assume Nix store paths. Non-Nix hosts: `make install` plus `dist/sift.service`.