chore: add Makefile with check gate, golangci-lint config, dockerignore

- make check runs lint + vet + test-short; lint is pinned to the go.mod
  toolchain so it works when the host Go is newer than golangci-lint's
- gofumpt main.go and patch.go; drop unused gatewayGroup/gatewayKind vars

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -13,13 +13,14 @@ Certificate's secret.
 ## Commands
 
 ```bash
-go build ./...                    # build
-go vet ./...                      # vet
-go test ./...                     # all tests
+make help                         # list targets
+make check                        # lint + vet + test-short (the pre-commit gate)
+make build                        # bin/manager
+make test                         # full suite, -race -cover
+make fmt                          # gofumpt -w .
+make run                          # run against the current kubeconfig context
+make docker-build IMG=gateway-cert-operator:dev
 go test -race -v -run TestName ./path/to/package   # single test
-golangci-lint run                 # lint
-go run .                          # run against the current kubeconfig context
-docker build -t gateway-cert-operator .
 kubectl kustomize deploy/         # render the manifests
 ```
 
@@ -150,6 +151,12 @@ Get the timestamp with `date "+%Y-%m-%d %H:%M %Z"`. Never write a literal placeh
 like `HH:MM` — always run `date` first to get the real current time. Skip trivial edits
 (typos, formatting, comment tweaks); only log changes a future reader would care about.
 
+### Quality gate
+
+`make check` is the one-shot pre-commit gate — it runs `golangci-lint`, `go vet` and
+`go test -short`, in that order. Do not declare a task complete if `make check`
+reports any failures.
+
 ### Reviews
 
 Before opening an MR for a feature, run the `operator-reviewer` and
@@ -237,6 +244,9 @@ Gitea Actions, workflows in `.gitea/workflows/`:
   deleted.
 - **`--metrics-bind-address` is parsed but ignored**; metrics are still served on
   controller-runtime's default `:8080`. Logging is hardcoded to zap dev mode.
+- **`make lint` pins `GOTOOLCHAIN` to the go.mod version.** golangci-lint cannot
+  type-check a standard library newer than the Go it was built with, so running
+  `golangci-lint run` directly fails when the host Go is ahead of it.
 - **No leader election**; safe only at `replicas: 1`.
 - **Deployment uses the mutable `:latest` tag**, so a new image does not roll out on
   its own.