Port the launcher to Go on the podman API bindings

Makefile

@@ -1,32 +1,59 @@
+BINARY       := agent-sandbox
+DIST         := dist
 IMAGE        := localhost/agent-sandbox:dev
 ROUTER_IMAGE := localhost/agent-sandbox-router:dev
-VERSION      := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
-SHELL_FILES  := agent-sandbox router/start.sh router/forwarder tests/test.sh scripts/build-rpm.sh
+# dev runs the local :dev images; a release tag pins the published images.
+VERSION      ?= dev
+GOFLAGS      := -ldflags="-s -w -X main.version=$(VERSION)"
+# podman-remote's build tags: the API bindings without cgo storage drivers.
+TAGS         := remote,exclude_graphdriver_btrfs,containers_image_openpgp
+OS           ?= $(shell go env GOOS)
+ARCH         ?= $(shell go env GOARCH)
 
-.PHONY: all build test lint pre-commit rpm clean patch minor major _tag
+.PHONY: all build bin images test vet lint fmt pre-commit clean completions rpm rpm-package patch minor major _tag
 
 all: build
 
-# Local images; the in-repo launcher (VERSION=dev) runs these by default.
-build:
+build: bin images
+
+bin:
+	CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build -tags $(TAGS) $(GOFLAGS) -o $(DIST)/$(BINARY) .
+
+images:
 	podman build --format docker -t $(IMAGE) .
 	podman build --format docker -t $(ROUTER_IMAGE) router
 
 test:
-	tests/test.sh
+	go test -tags $(TAGS) -v -race ./...
+
+vet:
+	go vet -tags $(TAGS) ./...
 
 lint:
-	uvx --from shellcheck-py shellcheck $(SHELL_FILES)
-	uvx --from hadolint-py hadolint Containerfile router/Containerfile
+	golangci-lint run ./...
+
+fmt:
+	gofmt -w .
 
 pre-commit:
 	@uvx pre-commit run --all-files
 
-rpm:
-	./scripts/build-rpm.sh $(VERSION)
-
 clean:
-	rm -rf dist
+	rm -rf $(DIST)
+
+# Generate bash/zsh/fish completions into dist/completions.
+completions: bin
+	@mkdir -p $(DIST)/completions
+	$(DIST)/$(BINARY) completion bash > $(DIST)/completions/$(BINARY).bash
+	$(DIST)/$(BINARY) completion zsh  > $(DIST)/completions/_$(BINARY)
+	$(DIST)/$(BINARY) completion fish > $(DIST)/completions/$(BINARY).fish
+
+# Build the binary then package it (with completions) into an RPM via nfpm.
+rpm: bin rpm-package
+
+# Package an already-built binary into an RPM (used by CI after the build step).
+rpm-package:
+	./scripts/build-rpm.sh $(VERSION)
 
 # Bump helpers — reads the latest semver tag and creates the next one.
 # If no tag exists yet, starts from v0.0.0.