p0: skeleton, dialer-Control URL guard, flake, Makefile

Go service with /healthz, SSRF guard (parse + resolve-all + Control),
exhaustive tests, NixOS module, and Makefile as source of truth for
build flags. nix flake check runs make test lint.

dist/sift.service

@@ -0,0 +1,41 @@
+[Unit]
+Description=sift LLM-oriented fetch and search
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=sift
+Group=sift
+ExecStart=/usr/local/bin/sift -listen 127.0.0.1:8890 -config /etc/sift/config.toml
+WorkingDirectory=/var/lib/sift
+Restart=on-failure
+RestartSec=5s
+
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectHostname=true
+ProtectClock=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged
+CapabilityBoundingSet=
+AmbientCapabilities=
+ReadWritePaths=/var/lib/sift
+ConfigurationDirectory=sift
+StateDirectory=sift
+
+[Install]
+WantedBy=multi-user.target

dist/sift.toml.example

@@ -0,0 +1,13 @@
+# sift configuration. P0 only uses -listen; remaining keys are reserved for P1+.
+# This file is an example: the service does not assume Nix store paths.
+
+listen = "127.0.0.1:8890"
+
+# [upstreams]
+# searxng = "http://127.0.0.1:8888"
+# dixie   = "http://dixie.scylla-hammerhead.ts.net:11434/v1"
+# honcho  = "http://rift.scylla-hammerhead.ts.net:8000"
+
+# [digest]
+# model = "ornith-1.5-9b-uncensored"
+# thinking = false