feat: package as pip-installable distribution

Turns the loose main.py into the 'swap-forge' distribution with a src layout, shipping both the swap-forge and the older swafo command.

A failing swap command no longer produces a traceback: CalledProcessError is caught and reported as "'mkswap' failed with exit code 1" at exit 1, a missing binary as exit 127. Required binaries are declared per filesystem path so an ext4 host is never asked for btrfs tooling.

The fstab entry is still written last, after swapon, so a failed activation leaves /etc/fstab untouched. The e2e suite proves that byte for byte across a create, a same-size rerun and a resize cycle, with real fallocate, chmod and file sizes.

Adds unit, integration and container-based e2e tests, ruff and markdown/mermaid linting, CodeQL and Dependabot, and pins the core metadata to 2.4 so twine accepts the artifacts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Makefile

@@ -0,0 +1,50 @@
+SHELL := /usr/bin/env bash
+
+.PHONY: help lint lint-docs format test test-unit test-integration test-e2e clean
+
+PY ?= python3
+E2E_IMAGE ?= swap-forge-e2e
+MD_LINT_IMAGE ?= davidanson/markdownlint-cli2:latest
+MERMAID_IMAGE ?= minlag/mermaid-cli:latest
+
+export PYTHONPATH := $(CURDIR)/src
+
+help:
+	@echo "Targets:"
+	@echo "  make lint             - ruff check + ruff format --check"
+	@echo "  make lint-docs        - markdownlint + mermaid diagram validation"
+	@echo "  make format           - apply ruff format"
+	@echo "  make test             - unit + integration tests"
+	@echo "  make test-unit        - unit tests only"
+	@echo "  make test-integration - integration tests only"
+	@echo "  make test-e2e         - install and exercise the CLI in a container"
+	@echo "  make clean            - remove caches"
+
+lint:
+	ruff check .
+	ruff format --check .
+
+# The repository is mounted read-only: mermaid-cli writes its SVGs next to the
+# output file, which must never land in the working tree.
+lint-docs:
+	docker run --rm -v "$(CURDIR)":/workdir $(MD_LINT_IMAGE) "**/*.md"
+	docker run --rm -v "$(CURDIR)":/data:ro -w /tmp $(MERMAID_IMAGE) -i /data/README.md -o /tmp/out.md
+
+format:
+	ruff format .
+
+test: test-unit test-integration
+
+test-unit:
+	$(PY) -m unittest discover -s tests/unit -t . -p "test_*.py"
+
+test-integration:
+	$(PY) -m unittest discover -s tests/integration -t . -p "test_*.py"
+
+test-e2e:
+	docker build -f tests/e2e/Dockerfile -t $(E2E_IMAGE) .
+	docker run --rm $(E2E_IMAGE)
+
+clean:
+	rm -rf .pytest_cache .ruff_cache .mypy_cache
+	find . -type d -name "__pycache__" -print0 | xargs -0 -r rm -rf