add khosra new, which writes the first bytes into a site root

Scaffolds a **directory** bundle — the only shape that can own local files, so the
other kind would hand an author a page their pictures cannot live beside. What it
writes is a draft: title, today's date, `draft: true`. A tool that publishes the
moment it runs publishes by accident, and drafts are honoured now.

This is the first thing that writes into somebody's content directory, so it goes
through os.Root like every read does (ADR-0031), and it never overwrites: an
existing bundle is an error.

Two bugs found by running it rather than by testing it:

A key of `../escape` did not fail. It never left the site root — path.Join collapses
`..` first — but it wrote a real directory *inside* the root and outside content/,
which is not an escape and not a bundle either. Refused outright now, the same guard
the include path needed for the same reason. The test asserts what should be true —
content/ is the only thing this creates — because the weaker assertion I wrote first
would have passed.

`khosra new posts/x -site dir` silently ignored -site, because Go's flag package
stops at the first non-flag argument, and then failed complaining there was no site
root. Parsed in rounds now, so either order works.

main() crossed the function-length warning as a result, so it became a dispatch
table with runServe beside it — the warning was right about the code.

Makefile

@@ -5,7 +5,7 @@ SITE ?= $(KHOSRA_SITE)
 ADDR ?= localhost:8080
 BIN  := ./khosra
 
-.PHONY: help build run check test verify fmt tidy clean
+.PHONY: help build run check new test verify fmt tidy clean
 
 help: ## list targets
 	@grep -hE '^[a-z]+:.*##' $(MAKEFILE_LIST) | sed 's/:[^#]*## /|/' | column -t -s '|'
@@ -21,6 +21,11 @@ check: build ## validate a site root's content: make check SITE=/path/to/site
 	@test -n "$(SITE)" || { echo "set SITE=/path/to/site, or export KHOSRA_SITE"; exit 1; }
 	$(BIN) check -site "$(SITE)"
 
+new: build ## scaffold a bundle: make new KEY=posts/hello-world SITE=/path/to/site
+	@test -n "$(SITE)" || { echo "set SITE=/path/to/site, or export KHOSRA_SITE"; exit 1; }
+	@test -n "$(KEY)" || { echo "set KEY=posts/hello-world"; exit 1; }
+	$(BIN) new -site "$(SITE)" "$(KEY)"
+
 test: ## run tests with the race detector
 	go test -race ./...