make: add help, build, lint to the canonical target set

build names the two binaries the Dockerfile ships (kmsd + kms) by calling
their existing recipes rather than repeating them; lint aliases vet, the one
static check this repo runs. help is the first target, so bare `make` now
prints the target list instead of building kmsd.

clean is unchanged — it already removed exactly the two binaries.

Co-authored-by: Hanzo Dev <[email protected]>

Makefile

@@ -1,18 +1,31 @@
 # Hanzo KMS
 
-kmsd:
+help: ## Show this help.
+	@awk 'BEGIN{FS=":.*##";printf "\nUsage: make <target>\n\nTargets:\n"} /^[a-zA-Z_-]+:.*##/{printf "  \033[36m%-16s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
+
+# What the image ships. The Dockerfile builds exactly these two binaries and no
+# others — cmd/kms-fetch and cmd/smoke-zap are helpers, not release artifacts.
+# It names the two recipes below rather than repeating them, so each binary has
+# one build. Those recipes stay a plain `go build`: the image adds CGO_ENABLED=0,
+# GOEXPERIMENT=jsonv2 and -ldflags="-s -w" on top, which is a release concern and
+# not what you want in the edit loop.
+build: kmsd kms ## Build both binaries the image ships: ./kmsd and ./kms.
+
+kmsd: ## Build the KMS server.
 	go build -o kmsd ./cmd/kmsd/
 
-kms:
+kms: ## Build the KMS CLI.
 	go build -o kms ./cmd/kms/
 
-test:
+test: ## Run the tests.
 	go test ./...
 
-vet:
+vet: ## Vet.
 	go vet ./...
 
-clean:
+lint: vet ## Lint — go vet, the one static check this repo runs.
+
+clean: ## Remove the built binaries.
 	rm -f kmsd kms
 
-.PHONY: kmsd kms test vet clean
+.PHONY: help build kmsd kms test vet lint clean