p0: skeleton, dialer-Control URL guard, flake, Makefile

Go service with /healthz, SSRF guard (parse + resolve-all + Control),
exhaustive tests, NixOS module, and Makefile as source of truth for
build flags. nix flake check runs make test lint.

dist/sift.service

@@ -0,0 +1,41 @@
+[Unit]
+Description=sift LLM-oriented fetch and search
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=sift
+Group=sift
+ExecStart=/usr/local/bin/sift -listen 127.0.0.1:8890 -config /etc/sift/config.toml
+WorkingDirectory=/var/lib/sift
+Restart=on-failure
+RestartSec=5s
+
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectHostname=true
+ProtectClock=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged
+CapabilityBoundingSet=
+AmbientCapabilities=
+ReadWritePaths=/var/lib/sift
+ConfigurationDirectory=sift
+StateDirectory=sift
+
+[Install]
+WantedBy=multi-user.target