feat: 将更多 Docker 命令改为内置实现，统一按名称/ID 解析目标

- exec/rm/rmi/stop/restart 支持名称、ID 或唯一 ID 前缀，目标不存在或
  前缀有歧义时在调用 docker 前报错；exec 默认 -it 并以 -- 分隔命令
- logs 新增 --since/--grep/--save；df 改为按占用排序的可读排行；
  stats 默认单次快照，无参数时统计全部运行中容器
- 破坏性确认：Command.ConfirmBuiltin 提供将删除对象的清单，
  rm/rmi 无 --yes 时列清单并退出码 2，拒绝 -f，运行中容器提示先 stop
- 抽出 executor/dockertargets.go 统一镜像/容器解析与 docker 调用

internal/registry/registry_test.go

@@ -213,6 +213,9 @@ func TestDockerCommandsWellFormed(t *testing.T) {
 	destructive := map[string]bool{
 		"docker.clearall":     true,
 		"docker.prunevolumes": true,
+		// rm/rmi now list their targets and require an explicit --yes.
+		"docker.rm":  true,
+		"docker.rmi": true,
 	}
 	needsArgs := map[string]int{
 		"docker.logs":    1,
@@ -231,8 +234,16 @@ func TestDockerCommandsWellFormed(t *testing.T) {
 	}
 	// Built from kopsc's own implementation rather than a fixed argv.
 	builtin := map[string]string{
-		"docker.save": "docker.save",
-		"docker.load": "docker.load",
+		"docker.df":      "docker.df",
+		"docker.exec":    "docker.exec",
+		"docker.logs":    "docker.logs",
+		"docker.stats":   "docker.stats",
+		"docker.load":    "docker.load",
+		"docker.restart": "docker.restart",
+		"docker.rm":      "docker.rm",
+		"docker.rmi":     "docker.rmi",
+		"docker.save":    "docker.save",
+		"docker.stop":    "docker.stop",
 	}
 
 	for i := range reg.Commands {