add initial Go implementation of arcline-audit

Implements the full site health auditor with four check groups:

  - SSL/TLS (certificate validity, expiry, chain, TLS version, ciphers)

  - HTTP (redirect chain, security headers, response time)

  - DNS (A/AAAA, MX, SPF, DKIM, DMARC, DNSSEC)

  - Infrastructure (CDN detection, common port probes)

Includes CLI with --checks filter, --json and --out flags,

cross-compile Makefile, and GitLab CI pipeline.

Signed-off-by: Blake Ridgway <blake@blakeridgway.com>

README.md

@@ -4,34 +4,93 @@ One-command site health auditor. Checks SSL, HTTP security headers, DNS records,
 
 Useful for onboarding new clients and producing a quick written report before an engagement starts.
 
-## Status
-
-Planned. Not yet started.
-
 ## Stack
 
 - Go — single static binary, no runtime dependencies
-- Reuses internal packages from `arcline-check` (ASN/CDN detection)
+- Standard library only — zero external dependencies
 
 ## Usage
 
 ```sh
+# Full audit (all checks)
 arcline-audit example.com
-arcline-audit example.com --checks ssl,dns,headers
+
+# Run specific checks
+arcline-audit example.com --checks ssl,dns
+
+# JSON output
 arcline-audit example.com --json
+
+# Write to file
 arcline-audit example.com --out report.txt
 ```
 
+### Flags
+
+| Flag | Description |
+|---|---|
+| `--checks` | Comma-separated check groups: `ssl`, `http`, `dns`, `infra` (default: `all`) |
+| `--json` | Output as JSON instead of terminal format |
+| `--out` | Write report to a file instead of stdout |
+
 ## Checks
 
 | Group | What it checks |
 |---|---|
-| SSL/TLS | Validity, expiry, chain, TLS version, cipher warnings |
-| HTTP | Redirect chain, security headers, server disclosure, response time |
-| DNS | A/AAAA, MX, SPF, DKIM, DMARC, DNSSEC, rDNS match |
-| Infrastructure | ASN/org, CDN detection, common open ports |
+| SSL/TLS | Certificate validity, expiry, chain completeness, TLS version, cipher suite warnings |
+| HTTP | Redirect chain (http→https), security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy), Server header disclosure, response time |
+| DNS | A/AAAA records, MX records, SPF, DKIM, DMARC, DNSSEC detection |
+| Infrastructure | CDN detection, common port probes (80, 443, 22, 3306, 5432) |
 
-See [todo.md](todo.md) for the full task list and output format spec.
+## Example output
+
+```
+$ arcline-audit example.com
+
+  ── SSL ────────────────────────────────────────────────
+  [OK]  valid certificate (2026-08-29)
+  [OK]  not self-signed
+  [OK]  certificate chain is complete
+  [OK]  TLS 1.3
+  [OK]  cipher suite: TLS_AES_128_GCM_SHA256
+
+  ── HTTP ───────────────────────────────────────────────
+  [WARN] no HSTS header
+  [WARN] Server header disclosed: cloudflare
+  [OK]  response time 34ms
+
+  ── DNS ────────────────────────────────────────────────
+  [OK]  A record: 104.20.23.154
+  [OK]  MX records present (1)
+  [OK]  SPF record found
+  [WARN] no DMARC record
+
+  ── Infrastructure ─────────────────────────────────────
+  [OK]  CDN detected: Cloudflare
+```
+
+## Build
+
+```sh
+# Local build
+make build
+
+# Cross-compile for all platforms
+make release
+```
+
+This produces:
+
+- `arcline-audit-linux-amd64`
+- `arcline-audit-darwin-amd64`
+- `arcline-audit-windows-amd64.exe`
+
+## Install
+
+```sh
+sudo cp arcline-audit-linux-amd64 /usr/local/bin/arcline-audit
+sudo chmod 0755 /usr/local/bin/arcline-audit
+```
 
 ## License