feat: 扩充 Docker 命令并新增 diagnose 状态诊断

- Docker：新增只读、生命周期、清理、Compose 共 32 条命令，Linux 自动适配 podman
- 危险命令 clearall/prunevolumes 未带 --yes 时仅提示并以退出码 2 结束
- 需要容器/镜像名的命令做必填参数校验，-- 之后参数计入位置参数
- diagnose：自动识别 Docker/Podman 容器或 K8s Pod，输出状态、根因、依据、建议并附日志与事件
- diagnose 中 -n 表示 namespace，其余命令 -n 仍为 --dry-run
- 新增内置动作桥接与平台变体 helper，补充单元/集成/CLI 测试与 README

internal/resolve/resolve_test.go

@@ -39,11 +39,11 @@ func TestResolveBuiltin(t *testing.T) {
 		wantIdx   int
 	}{
 		{
-			name:      "centos with podman and docker prefers the distro-specific podman variant",
+			name:      "centos with podman and docker prefers podman",
 			id:        "docker.clearsafe",
 			info:      env("linux", "amd64", "centos", []string{"rhel", "fedora"}, "docker", "podman"),
 			wantArgv:  []string{"podman", "system", "prune", "-f"},
-			wantScore: 5,
+			wantScore: 2,
 			wantIdx:   0,
 		},
 		{
@@ -51,7 +51,7 @@ func TestResolveBuiltin(t *testing.T) {
 			id:        "docker.clearsafe",
 			info:      env("linux", "amd64", "centos", []string{"rhel", "fedora"}, "docker"),
 			wantArgv:  []string{"docker", "system", "prune", "-f"},
-			wantScore: 5,
+			wantScore: 2,
 			wantIdx:   1,
 		},
 		{
@@ -60,7 +60,7 @@ func TestResolveBuiltin(t *testing.T) {
 			info:      env("linux", "amd64", "ubuntu", []string{"debian"}, "docker", "podman"),
 			wantArgv:  []string{"podman", "system", "prune", "-f"},
 			wantScore: 2,
-			wantIdx:   2,
+			wantIdx:   0,
 		},
 		{
 			name:      "rocky inherits the generic linux docker variant",
@@ -68,7 +68,7 @@ func TestResolveBuiltin(t *testing.T) {
 			info:      env("linux", "amd64", "rocky", []string{"rhel", "centos"}, "docker"),
 			wantArgv:  []string{"docker", "system", "prune", "-f"},
 			wantScore: 2,
-			wantIdx:   3,
+			wantIdx:   1,
 		},
 		{
 			name:      "darwin docker",
@@ -76,7 +76,7 @@ func TestResolveBuiltin(t *testing.T) {
 			info:      env("darwin", "arm64", "", nil, "docker"),
 			wantArgv:  []string{"docker", "system", "prune", "-f"},
 			wantScore: 2,
-			wantIdx:   4,
+			wantIdx:   2,
 		},
 		{
 			name:      "windows docker",
@@ -84,7 +84,7 @@ func TestResolveBuiltin(t *testing.T) {
 			info:      env("windows", "amd64", "", nil, "docker"),
 			wantArgv:  []string{"docker", "system", "prune", "-f"},
 			wantScore: 2,
-			wantIdx:   5,
+			wantIdx:   3,
 		},
 		{
 			name:      "centos refreshes with dnf exactly",