refactor: add pg_autoctl inspect and manual sub-command groups

[dimitri]

Summary

Add two new always-visible sub-command groups to pg_autoctl, and remove the PG_AUTOCTL_DEBUG command-visibility gate:

• pg_autoctl inspect — read-only diagnostics: pgsetup, fsm state/list/gv, monitor queries, network/show utilities. Safe to run on a live node.
• pg_autoctl manual — operator-driven FSM operations for manual cluster recovery: fsm init/assign/step/nodes, service restart/pgctl, monitor register/active/version, primary/standby/coordinator ops.

Both groups are always visible in pg_autoctl --help. PG_AUTOCTL_DEBUG now only controls log verbosity — the root_with_debug dual-root pattern and the env-var command-dispatch gate are deleted.

Sub-process entry points are registered as a hidden pg_autoctl internal service command set — routable but absent from --help. The supervisor spawns pg_autoctl internal service postgres|listener|node-active instead of the old pg_autoctl do service ... path.

Changes

New dispatch layer

• cli_inspect.c / cli_inspect.h: new pg_autoctl inspect dispatch (fsm, pgsetup, monitor, show, getpid)
• cli_manual.c / cli_manual.h: new pg_autoctl manual dispatch (fsm, service, monitor, primary, standby, coordinator)
• cli_root.c: add &inspect_commands, &manual_commands, &internal_commands to the root sub-command table

Hidden internal entry points

• cli_do_root.c: add hidden pg_autoctl internal service (pgcontroller, postgres, listener, node-active) via make_hidden_command_set
• commandline.h / commandline.c: add bool hidden field to CommandLine struct; add make_hidden_command_set macro; skip hidden commands in commandline_pretty_print_subcommands

Supervisor fix

• service_postgres_ctl.c, service_monitor.c, service_keeper.c: supervisor spawns pg_autoctl internal service ... instead of the deleted pg_autoctl do service ... path

Symbol visibility

• cli_do_fsm.c: remove static from fsm_init/state/list/gv/assign/step so cli_inspect.c and cli_manual.c can compose them
• cli_do_monitor.c: remove static from monitor_get_command, monitor_parse_notification_command, monitor_register_command, monitor_node_active_command, monitor_version_command
• cli_do_root.h: updated extern declarations for all newly-public symbols

Dead-code removal

• cli_root.c / cli_root.h: delete root_with_debug and root_subcommands_with_debug (now identical to root)
• main.c, cli_common.c: remove env_exists(PG_AUTOCTL_DEBUG) command-dispatch blocks

Tests and docs

• tests/pgautofailover_utils.py: update do pgsetup → inspect pgsetup, do fsm → inspect fsm (read-only) or manual fsm (mutating), do service restart → manual service restart
• Add docs/ref/pg_autoctl_inspect.rst, pg_autoctl_inspect_pgsetup.rst, pg_autoctl_inspect_show.rst, pg_autoctl_manual.rst, pg_autoctl_manual_service_restart.rst
• Trim docs/ref/pg_autoctl_do.rst to tmux/demo only; delete superseded pgsetup/show/service_restart pages
• Update docs/ref/manual.rst toctree and docs/failover-state-machine.rst (remove PG_AUTOCTL_DEBUG=1 requirement from inspect fsm gv example)

Testing

Verified locally with a full test_basic_operation run (32 tests, OK) against a PG 17 Docker image.