Enforce Go best practices (task 344)

- Magefile.go: add Default() target so bare `mage` builds the binary;
  fix Install()/Uninstall() to use $GOPATH/bin (default ~/go/bin) instead
  of the previous hardcoded ~/.local/bin path; use cp -v for visibility;
  fix 0755 -> 0o755 octal literal in createBinDir; extract binaryName const
- cmd/geheim/main.go: add -version flag (prints version.Version and exits);
  pass flag.Args() instead of os.Args[1:] so flags are parsed cleanly
- internal/cli/cli.go: remove dead fatal() and prompt() helpers that were
  never called anywhere in the codebase

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 17 insertions, 3 deletions

diff --git a/cmd/geheim/main.go b/cmd/geheim/main.go
index 4c432e8..1d5f6e6 100644
--- a/cmd/geheim/main.go
+++ b/cmd/geheim/main.go
@@ -1,19 +1,30 @@
 // main is the thin entry point for the geheim binary.
-// It sets up a signal-cancellable context, initialises the CLI, and exits
-// with the code returned by Run.  All command logic lives in internal/cli.
+// It handles the -version flag, sets up a signal-cancellable context,
+// initialises the CLI, and exits with the code returned by Run.
+// All command logic lives in internal/cli.
 package main
 
 import (
 	"context"
+	"flag"
 	"fmt"
 	"os"
 	"os/signal"
 	"syscall"
 
 	"codeberg.org/snonux/geheim/internal/cli"
+	"codeberg.org/snonux/geheim/internal/version"
 )
 
 func main() {
+	// -version prints the build version and exits immediately.
+	versionFlag := flag.Bool("version", false, "print version and exit")
+	flag.Parse()
+	if *versionFlag {
+		fmt.Println(version.Version)
+		os.Exit(0)
+	}
+
 	// Cancel the context on SIGINT or SIGTERM so that long-running operations
 	// (fzf, external editors) terminate gracefully rather than being killed hard.
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
@@ -25,5 +36,8 @@ func main() {
 		os.Exit(3)
 	}
 
-	os.Exit(c.Run(ctx, os.Args[1:]))
+	// flag.Args() returns arguments after flags, so flag-aware invocations
+	// like `geheim -version` work while plain `geheim cat foo` still passes
+	// all args through unchanged.
+	os.Exit(c.Run(ctx, flag.Args()))
 }