feat: 将更多 Docker 命令改为内置实现，统一按名称/ID 解析目标

- exec/rm/rmi/stop/restart 支持名称、ID 或唯一 ID 前缀，目标不存在或
  前缀有歧义时在调用 docker 前报错；exec 默认 -it 并以 -- 分隔命令
- logs 新增 --since/--grep/--save；df 改为按占用排序的可读排行；
  stats 默认单次快照，无参数时统计全部运行中容器
- 破坏性确认：Command.ConfirmBuiltin 提供将删除对象的清单，
  rm/rmi 无 --yes 时列清单并退出码 2，拒绝 -f，运行中容器提示先 stop
- 抽出 executor/dockertargets.go 统一镜像/容器解析与 docker 调用

internal/executor/executor.go

@@ -57,6 +57,12 @@ func (p Plan) Display() string {
 	return strings.Join(argv, " ")
 }
 
+// PreviewBuiltin returns the builtin advertised by the resolved command for
+// listing what it would touch, or "" when the command has none.
+func (p Plan) PreviewBuiltin() string {
+	return p.Result.Command.ConfirmBuiltin
+}
+
 // Explain writes why this variant was chosen and what will run.
 func (p Plan) Explain(w io.Writer) {
 	if w == nil {