feat: 新增 net pids 端口占用查询并补齐 README

- kopsc net pids <端口> 等价 lsof -ti:<端口>，输出 PID 升序去重、每行一个
- Linux 回退链 lsof -> ss -> /proc；macOS 使用 lsof；Windows 解析 netstat -ano
- 端口 1-65535 校验，无占用时无输出并正常退出
- README 新增 net.pids 小节，修正过时的匹配示例、-n 例外说明与目录结构

internal/cli/cli_test.go

@@ -460,6 +460,29 @@ func TestDiagnoseRequiresTarget(t *testing.T) {
 	}
 }
 
+func TestNetPidsDryRun(t *testing.T) {
+	app, stdout, stderr := testApp(centos("docker"))
+
+	if code := app.Execute([]string{"net", "pids", "8080", "--dry-run"}); code != 0 {
+		t.Fatalf("exit code = %d, stderr=%s", code, stderr.String())
+	}
+	out := stdout.String()
+	if !strings.Contains(out, "(内置) net.pids 8080") {
+		t.Errorf("dry-run output missing builtin plan:\n%s", out)
+	}
+}
+
+func TestNetPidsRequiresPort(t *testing.T) {
+	app, _, stderr := testApp(centos("docker"))
+
+	if code := app.Execute([]string{"net", "pids"}); code != 1 {
+		t.Fatalf("exit code = %d, want 1", code)
+	}
+	if !strings.Contains(stderr.String(), "缺少参数") {
+		t.Errorf("stderr = %s", stderr.String())
+	}
+}
+
 // TestCLIHelperProcess is re-executed as a child to verify exit-code passthrough.
 func TestCLIHelperProcess(t *testing.T) {
 	if os.Getenv("KOPSC_CLI_HELPER") != "1" {