Move the command to cmd/sfdupes and the code to internal/sfdupes (closes #157)

The root held every .go file in package main, so no ref had the
path cmd/sfdupes that go install was given. cmd/sfdupes/main.go now
only calls sfdupes.Main; the rest is package internal/sfdupes, with
main.go renamed to cli.go. The Makefile builds ./cmd/sfdupes and sets
Version by its new import path. README and TODO.md give the new
install path and file paths.

The test files carry //nolint:testpackage: they test unexported
functions, which the linter allowed only in package main.

Model: opus-5-5

README.md

@@ -57,25 +57,25 @@ shell shows both on the terminal, and `>` redirects stdout alone.
 With Go installed, this builds and installs the newest tagged release:
 
 ```sh
-go install sneak.berlin/go/sfdupes@latest
+go install sneak.berlin/go/sfdupes/cmd/sfdupes@latest
 ```
 
 `@main` installs the tip of the `main` branch instead:
 
 ```sh
-go install sneak.berlin/go/sfdupes@main
+go install sneak.berlin/go/sfdupes/cmd/sfdupes@main
 ```
 
 The binary goes to `$(go env GOPATH)/bin`, or to `$GOBIN` when that is set.
 
 `sfdupes --version` prints `sfdupes VERSION` and exits. For a binary from
 `go install`, `VERSION` is the version Go recorded in it. For `@latest` that is
-a release tag such as `v0.0.3`. For `@main` it is the commit's tag when it has
-one. Otherwise it is a pseudo-version, Go's version string for an untagged
-commit. That string ends in the commit's hash. A binary built from a clone
-carries the output of `git describe --tags --always --dirty` in that clone, such
-as `v0.0.3` on a tagged commit. `VERSION` is `dev` when no version is known. To
-see everything Go recorded in an installed binary:
+a release tag. For `@main` it is the commit's tag when it has one. Otherwise it
+is a pseudo-version, Go's version string for an untagged commit. That string
+ends in the commit's hash. A binary built from a clone carries the output of
+`git describe --tags --always --dirty` in that clone, such as `v0.0.3` on a
+tagged commit. `VERSION` is `dev` when no version is known. To see everything Go
+recorded in an installed binary:
 
 ```sh
 go version -m "$(command -v sfdupes)"
@@ -1421,8 +1421,9 @@ All of the following, run in this directory, must pass:
     because its content changed. `copy.bin` and `copy2.bin` remain as one pair.
     `unique.bin` is gone from the database.
 
-    The test suite automates this scenario (see `scan_test.go`). It also checks
-    that `report` and `trees` never touch the scanned filesystem.
+    The test suite automates this scenario (see
+    `internal/sfdupes/scan_test.go`). It also checks that `report` and `trees`
+    never touch the scanned filesystem.
 
 ## TODO