add Makefile, ci scripts, and pinned tooling

Root Makefile drives both the Go sidecar under sidecar/ and the Flutter
app under app/ through one interface. Mirrors the pql/claudian pattern:
VERSION read from project.yaml via awk and stamped into the sidecar
binary via -ldflags -X, so the version the codebase claims to be and
the version the binary reports cannot drift.

Flutter targets (app-analyze, app-test, app-build-*) check for
app/pubspec.yaml and flutter on PATH and gracefully noop when either
is missing. That makes the Makefile usable today — before the app is
scaffolded — without ceremony.

ci/ scripts shell out to the Makefile so local dev and CI run the same
commands. lint.sh includes the supply-chain gate (make security) so
there is no version of "green lint, known-vulnerable dep" that CI
accepts.

make tools installs govulncheck, goimports, and golangci-lint at
exact pinned versions — bump deliberately, never floating.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ci/lint.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# CI entry: lint + supply-chain gates. Security runs here too so a
+# merge-blocking lint failure and a merge-blocking CVE failure share
+# one CI job — there is no version of "lint passed but we shipped a
+# known-vulnerable dep" that is acceptable in this repo.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+make lint
+make app-analyze
+make security

ci/release.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# CI entry: release pipeline. Stub — wire goreleaser + flutter build
+# artifacts later.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+echo "TODO: goreleaser release (sidecar) + flutter build (app) + publish"
+exit 64

ci/security.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# CI entry: supply-chain + CVE gate. Shells out to Makefile targets so
+# local dev and CI run the same commands.
+#
+# See ~/.claude/projects/-var-mnt-data-projects-clide/memory/ for the
+# standing requirements: Go deps must be version-locked and CVE-checked;
+# Dart deps prefer zero, with what remains pinned and audited.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+make security

ci/test.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# CI entry: run the full test matrix. Shells out to Makefile targets.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+make test
+make test-race
+make app-test