feat: 将更多 Docker 命令改为内置实现，统一按名称/ID 解析目标

- exec/rm/rmi/stop/restart 支持名称、ID 或唯一 ID 前缀，目标不存在或
  前缀有歧义时在调用 docker 前报错；exec 默认 -it 并以 -- 分隔命令
- logs 新增 --since/--grep/--save；df 改为按占用排序的可读排行；
  stats 默认单次快照，无参数时统计全部运行中容器
- 破坏性确认：Command.ConfirmBuiltin 提供将删除对象的清单，
  rm/rmi 无 --yes 时列清单并退出码 2，拒绝 -f，运行中容器提示先 stop
- 抽出 executor/dockertargets.go 统一镜像/容器解析与 docker 调用

internal/registry/registry.go

@@ -49,6 +49,11 @@ type Command struct {
 	// RequiresYes marks destructive commands: without an explicit --yes they
 	// print what they would do and exit non-zero instead of running.
 	RequiresYes bool
+	// ConfirmBuiltin names a builtin that lists exactly what the command would
+	// touch (the containers or images about to be deleted). It runs before the
+	// confirmation prompt and for --dry-run; its output is shown to the
+	// caller. Empty means "no preview available".
+	ConfirmBuiltin string
 	// Namespaced marks Kubernetes-aware commands where -n means --namespace
 	// (kubectl style) instead of the global --dry-run shorthand.
 	Namespaced bool