feat: 将更多 Docker 命令改为内置实现，统一按名称/ID 解析目标

- exec/rm/rmi/stop/restart 支持名称、ID 或唯一 ID 前缀，目标不存在或
  前缀有歧义时在调用 docker 前报错；exec 默认 -it 并以 -- 分隔命令
- logs 新增 --since/--grep/--save；df 改为按占用排序的可读排行；
  stats 默认单次快照，无参数时统计全部运行中容器
- 破坏性确认：Command.ConfirmBuiltin 提供将删除对象的清单，
  rm/rmi 无 --yes 时列清单并退出码 2，拒绝 -f，运行中容器提示先 stop
- 抽出 executor/dockertargets.go 统一镜像/容器解析与 docker 调用

internal/executor/dockersave_test.go

@@ -49,6 +49,15 @@ func TestLooksLikeImageID(t *testing.T) {
 // `images --format` payload; every invocation is appended to the returned log
 // file as one line.
 func fakeRuntime(t *testing.T, images string) (logPath string) {
+	t.Helper()
+	return fakeRuntimeScript(t, images, "", "")
+}
+
+// fakeRuntimeScript installs a fake `docker` on PATH. images and ps are the
+// payloads of `docker images --format ...` and `docker ps -a --format ...`;
+// every invocation is appended to the returned log file as one line. Empty
+// payloads print nothing.
+func fakeRuntimeScript(t *testing.T, images, ps, extraCase string) (logPath string) {
 	t.Helper()
 	dir := t.TempDir()
 	logPath = filepath.Join(dir, "calls.log")
@@ -59,6 +68,9 @@ func fakeRuntime(t *testing.T, images string) (logPath string) {
 		"case \"$1\" in\n" +
 		"  images) cat <<'EOF'\n" + images + "\nEOF\n" +
 		"    ;;\n" +
+		"  ps) cat <<'EOF'\n" + ps + "\nEOF\n" +
+		"    ;;\n" +
+		extraCase +
 		"esac\n"
 	if err := os.WriteFile(filepath.Join(dir, "docker"), []byte(script), 0o755); err != nil {
 		t.Fatal(err)