Move the command to cmd/sfdupes and the code to internal/sfdupes (closes #157)

`go install sneak.berlin/go/sfdupes/cmd/sfdupes@...` found no package: the command was built from `package main` in the repository root. It now lives in `cmd/sfdupes/main.go`, whose one call is `sfdupes.Main()`, and every other Go file moved with `git mv` to `internal/sfdupes`, as `REPO_POLICIES.md` and the Go style guide require. The `Makefile` builds `./cmd/sfdupes` and sets `Version` by its new import path. README "Install" and `TODO.md` give the new paths; the fleet-written "flat layout" divergence is gone.

Rule suppressed: each test file carries `//nolint:testpackage`, since the tests call unexported functions throughout.

Model: opus-5-5

Makefile

@@ -4,7 +4,7 @@ export CGO_ENABLED = 0
 
 BINARY := sfdupes
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
-LDFLAGS := -X main.Version=$(VERSION)
+LDFLAGS := -X sneak.berlin/go/sfdupes/internal/sfdupes.Version=$(VERSION)
 
 .PHONY: sfdupes build bootstrap setup test lint fmt fmt-check check docker hooks clean
 
@@ -14,7 +14,7 @@ LDFLAGS := -X main.Version=$(VERSION)
 # Default target: build the binary. Phony so go build (which has its
 # own build cache) always decides what to recompile.
 sfdupes:
-	go build -ldflags "$(LDFLAGS)" -o $(BINARY)
+	go build -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/sfdupes
 
 build: sfdupes