add Makefile, ci scripts, and pinned tooling

Root Makefile drives both the Go sidecar under sidecar/ and the Flutter
app under app/ through one interface. Mirrors the pql/claudian pattern:
VERSION read from project.yaml via awk and stamped into the sidecar
binary via -ldflags -X, so the version the codebase claims to be and
the version the binary reports cannot drift.

Flutter targets (app-analyze, app-test, app-build-*) check for
app/pubspec.yaml and flutter on PATH and gracefully noop when either
is missing. That makes the Makefile usable today — before the app is
scaffolded — without ceremony.

ci/ scripts shell out to the Makefile so local dev and CI run the same
commands. lint.sh includes the supply-chain gate (make security) so
there is no version of "green lint, known-vulnerable dep" that CI
accepts.

make tools installs govulncheck, goimports, and golangci-lint at
exact pinned versions — bump deliberately, never floating.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ci/security.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# CI entry: supply-chain + CVE gate. Shells out to Makefile targets so
+# local dev and CI run the same commands.
+#
+# See ~/.claude/projects/-var-mnt-data-projects-clide/memory/ for the
+# standing requirements: Go deps must be version-locked and CVE-checked;
+# Dart deps prefer zero, with what remains pinned and audited.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+make security