Add dev harness routing all builds through the digest-pinned builder

Every compile/vet/test path goes through the same golang:1.26-bookworm
digest container used by mopac-keyproxy, so the host stays toolchain-free
and builds are reproducible. Makefile is a thin front door over dev.sh.

Makefile

@@ -0,0 +1,19 @@
+# Makefile: thin front door over dev.sh so `make build/vet/test/check/smoke`
+# route through the digest-pinned Docker builder (ALL dev work in Docker —
+# the host never runs a Go toolchain).
+.PHONY: build vet test check smoke
+
+build:
+	@./dev.sh build
+
+vet:
+	@./dev.sh vet
+
+test:
+	@./dev.sh test
+
+check:
+	@./dev.sh check
+
+smoke:
+	@./dev.sh smoke