feat: 扩充 Docker 命令并新增 diagnose 状态诊断

- Docker：新增只读、生命周期、清理、Compose 共 32 条命令，Linux 自动适配 podman
- 危险命令 clearall/prunevolumes 未带 --yes 时仅提示并以退出码 2 结束
- 需要容器/镜像名的命令做必填参数校验，-- 之后参数计入位置参数
- diagnose：自动识别 Docker/Podman 容器或 K8s Pod，输出状态、根因、依据、建议并附日志与事件
- diagnose 中 -n 表示 namespace，其余命令 -n 仍为 --dry-run
- 新增内置动作桥接与平台变体 helper，补充单元/集成/CLI 测试与 README

internal/diagnose/runner.go

@@ -0,0 +1,54 @@
+// Package diagnose explains why a container or Pod is in its current state.
+// It knows how to inspect Docker/Podman containers and Kubernetes Pods, and
+// falls back to a built-in implementation so the output is identical on every
+// platform.
+package diagnose
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"os/exec"
+)
+
+// CommandResult is the output of one external command.
+type CommandResult struct {
+	Stdout   []byte
+	Stderr   []byte
+	ExitCode int
+}
+
+// Runner executes external programs. It is an interface so diagnoses can be
+// tested without docker or kubectl.
+type Runner interface {
+	LookPath(name string) (string, error)
+	Run(ctx context.Context, name string, args ...string) (CommandResult, error)
+}
+
+// ExecRunner runs commands on the host.
+type ExecRunner struct{}
+
+// LookPath reports whether a program is available on PATH.
+func (ExecRunner) LookPath(name string) (string, error) {
+	return exec.LookPath(name)
+}
+
+// Run executes a command and captures its output.
+func (ExecRunner) Run(ctx context.Context, name string, args ...string) (CommandResult, error) {
+	cmd := exec.CommandContext(ctx, name, args...)
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err := cmd.Run()
+	result := CommandResult{Stdout: stdout.Bytes(), Stderr: stderr.Bytes()}
+	if err == nil {
+		return result, nil
+	}
+
+	var exitErr *exec.ExitError
+	if errors.As(err, &exitErr) {
+		result.ExitCode = exitErr.ExitCode()
+	}
+	return result, err
+}