feat: 优化非 Docker 命令的易用性，修复带 digest 镜像无法按名称查找

- docker save/rmi：镜像名不再拼接 digest（{{.Digest}} 对多数镜像输出
  sha256:…，导致 alpine:3.20 被存成 alpine:3.20@sha256:… 而查不到），
  digest 单独保存；同时修正自定义 --format 输出中 IMAGE ID 表头未被过滤
- diagnose：目标不存在时给出相似名称候选，无相似时列出当前存在的对象
- net.pids：无进程占用时向 stderr 提示且 stdout 保持为空，新增 --pid-file
- net.ports：默认输出跨平台一致的端口表格，--raw 保留原生命令输出
- disk.usage：路径可省略（默认当前目录），新增 --depth N 控制层级

internal/resolve/resolve_test.go

@@ -125,24 +125,26 @@ func TestResolveBuiltin(t *testing.T) {
 			wantIdx:  5,
 		},
 		{
-			name:     "linux listens with ss",
+			// net.ports is now a builtin: the resolver picks the platform
+			// variant and the builtin renders the table (or --raw output).
+			name:     "linux listens with the builtin",
 			id:       "net.ports",
 			info:     env("linux", "amd64", "centos", []string{"rhel"}),
-			wantArgv: []string{"ss", "-tulnp"},
+			wantArgv: nil,
 			wantIdx:  0,
 		},
 		{
-			name:     "darwin listens with lsof",
+			name:     "darwin listens with the builtin",
 			id:       "net.ports",
 			info:     env("darwin", "amd64", "", nil),
-			wantArgv: []string{"lsof", "-iTCP", "-sTCP:LISTEN", "-nP"},
+			wantArgv: nil,
 			wantIdx:  1,
 		},
 		{
-			name:     "windows listens with netstat",
+			name:     "windows listens with the builtin",
 			id:       "net.ports",
 			info:     env("windows", "amd64", "", nil),
-			wantArgv: []string{"netstat", "-ano"},
+			wantArgv: nil,
 			wantIdx:  2,
 		},
 	}