test: Add structural tests, CI, and Codecov coverage (with make build fixes)

[Saggre]

Summary

Adds professional structural tests, CI, and coverage reporting, and fixes the broken make targets found while getting the tool to run.

Tests

Structural unit tests (Go testing, standard library only, table-driven with subtests) for the parser's core, build/arch-specific logic:

• readelf: ELF segment lookup, virtual-address math, little-endian encoding.
• parser: the sshkey struct offset parsing that recovers the shielded blob and 16 KB prekey, including invalid-prekey-length, out-of-range-pointer, and truncated-buffer edge cases, plus byte-search and integer reads.

The functions under test are at 100% statement coverage; the end-to-end test (make test) covers the real recovery path against a generated ssh-agent core dump.

CI and coverage

• .github/workflows/ci.yml: a unit job runs the tests with the race detector and coverage on every push and pull request and uploads to Codecov; an integration job runs the end-to-end test.
• Coverage goes to Codecov (codecov/codecov-action@v5), no disposable branch or self-hosted badge JSON. codecov.yml marks coverage informational so it never fails CI.
• The README shows the CI status badge and the Codecov coverage badge.

Makefile fixes

• make build no longer starts with a host-side go build at the repo root (no go.mod there); it builds the container images, so no host Go toolchain is needed.
• make test no longer points at a non-existent ./test-dump-generator/dump.sh.
• Adds make test-unit, make test-cover, and make test-all.

README and LICENSE

This branch also carries the full README.md (with badges and a Testing section) and the MIT LICENSE, which originated in the separate README PR (#1). Since that content is included and current here, #1 can be closed as superseded once this merges.

One-time Codecov setup

Codecov needs the repo activated once at https://app.codecov.io (sign in with GitHub), then add a CODECOV_TOKEN repository secret. When the repo is made public, uploads become tokenless and the badge is public with no token in the URL.

Testing done

Verified locally on x86_64 Linux with Docker 29.6.1:

• go test -race -covermode=atomic ./... (in golang:1.23): all tests pass, go vet clean, coverage profile generated.
• make test end-to-end: recovered key byte-identical to the original (matching SSH fingerprint).
• make build: builds both images with no host Go.
• CI workflow validated with actionlint (clean); codecov.yml YAML validated.