feat: 扩充 Docker 命令并新增 diagnose 状态诊断

- Docker：新增只读、生命周期、清理、Compose 共 32 条命令，Linux 自动适配 podman
- 危险命令 clearall/prunevolumes 未带 --yes 时仅提示并以退出码 2 结束
- 需要容器/镜像名的命令做必填参数校验，-- 之后参数计入位置参数
- diagnose：自动识别 Docker/Podman 容器或 K8s Pod，输出状态、根因、依据、建议并附日志与事件
- diagnose 中 -n 表示 namespace，其余命令 -n 仍为 --dry-run
- 新增内置动作桥接与平台变体 helper，补充单元/集成/CLI 测试与 README

internal/executor/builtin.go

@@ -3,6 +3,9 @@ package executor
 import (
 	"context"
 	"io"
+
+	"gitea.odboy.cn/odboy/kenaito-kopsc/internal/diagnose"
+	"gitea.odboy.cn/odboy/kenaito-kopsc/internal/platform"
 )
 
 // BuiltinRequest carries the caller's arguments and output streams to an
@@ -11,6 +14,7 @@ type BuiltinRequest struct {
 	Args   []string
 	Stdout io.Writer
 	Stderr io.Writer
+	Info   platform.Info
 }
 
 // Builtin executes a command inside kopsc instead of spawning a child. It is
@@ -19,6 +23,13 @@ type Builtin func(ctx context.Context, req BuiltinRequest) error
 
 var builtins = map[string]Builtin{
 	"disk.usage": runDiskUsage,
+	"diagnose":   runDiagnose,
+}
+
+// runDiagnose bridges the registry builtin to the diagnose package.
+func runDiagnose(ctx context.Context, req BuiltinRequest) error {
+	service := diagnose.New(req.Info, diagnose.ExecRunner{}, req.Stdout, req.Stderr)
+	return service.Run(ctx, req.Args)
 }
 
 // LookupBuiltin returns the implementation registered under name.

internal/executor/executor.go

@@ -106,7 +106,12 @@ func (p Plan) Run(ctx context.Context, opts Options) error {
 		if !ok {
 			return fmt.Errorf("未注册的内置动作 %q", variant.Builtin)
 		}
-		return fn(ctx, BuiltinRequest{Args: p.ExtraArgs, Stdout: opts.Stdout, Stderr: opts.Stderr})
+		return fn(ctx, BuiltinRequest{
+			Args:   p.ExtraArgs,
+			Stdout: opts.Stdout,
+			Stderr: opts.Stderr,
+			Info:   p.Result.Info,
+		})
 	}
 
 	name, args := p.command()