feat(cli): add shell flag-value completion for --checks/--export/--proxy-type

[MsfPablo]

What

Closes #22 — shell completion support.

Background

Cobra already generates a completion command (bash/zsh/fish/powershell) that outputs valid scripts and completes subcommands + flag names. That covers two of the three acceptance criteria out of the box. The real gap is the third criterion ("completions work with all subcommands and flags"): flag values are not completed. diagnose --checks <Tab> fell back to file completion, and --export / --proxy-type likewise.

Changes

• cmd/cli/commands/completion.go — registers flag-value completion functions:
  • --checks: default check IDs + their categories + the literal all, with comma-segment completion (only the final segment is narrowed, preserving the typed prefix).
  • --export: text / json / html / markdown.
  • --proxy-type: auto / http / https / socks4 / socks5.
• cmd/cli/commands/completion_test.go — unit tests for each helper (prefix filtering, comma handling, exhaustive value sets, NoFileComp directive).
• README.md — new "Shell Completion" section with per-shell install instructions.

Registration uses cobra.OnInitialize rather than a bare init(): Go runs package init()s in filename order, so completion.go runs before diagnose.go / plugins.go define the --checks / --export / --proxy-type flags, and RegisterFlagCompletionFunc rejects a missing flag. Deferring to Execute time runs after every init() has completed.

Verification

• go build ./cmd/cli ✅
• go test ./cmd/cli/commands/... ✅
• End-to-end via the __complete hidden command:
  • __complete diagnose --checks d → dns_leak, dns_resolve (:4 NoFileComp)
  • __complete diagnose --checks public_ip,dns → public_ip,dns_leak, public_ip,dns_resolve
  • __complete diagnose --proxy-type s → socks4, socks5
  • __complete diagnose --export m → markdown

go test ./... shows one failure in core/adapters (TestAdapterHTTPSProxy_HTTPRequest, an x509 cert-verification error in a local HTTPS-proxy fixture). It reproduces identically on master without these changes and is unrelated to cmd/cli/commands.

Note

The completion script is keyed to the root command name (proxyctl); the README section calls this out for anyone invoking the binary under a different name.