refactor(devtool): move the commands into internal/devtools

cmd/devtool had no test, so go tool mutate reported every edit in it as
untested. Its commands now live in devtools.Main, which takes the
arguments and standard streams and returns the exit code; main only hands
it the process's. Tests drive each command through Main with fake sudo,
docker, go, sh and node first on PATH and throwaway git repositories, so
nothing touches the host, and assert the output, exit codes, calls and
file modes the Taskfile and workflows depend on. ci-prepare-runner's
decision is split into prepareRunner(free) so both disk branches are
tested. Command lines, output and exit codes are unchanged: an old and a
new build gave identical results for every command run locally.

readLines drops its 4 MiB scanner buffer: git prints paths, which
PATH_MAX keeps far below the default 64 KiB token limit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: aledbf