fix: report the real version for go-installed binaries

[juangracia]

Follow-up polish found while verifying the v0.5.0 release end to end.

The problem

go install github.com/juangracia/gitrespect/cmd/gitrespect@latest produces a binary that goreleaser never stamped with ldflags, so it reported itself as dev:

$ go install github.com/juangracia/gitrespect/cmd/gitrespect@latest
$ gitrespect version
gitrespect dev

That is the install path the README leads with, so the most common way to get gitrespect produced a binary that could not tell you what it was.

The fix

Fall back to the module version from debug.ReadBuildInfo(), but only when the binary actually came from the module proxy.

That condition matters. A build from a local checkout derives Main.Version from the nearest tag, so naively trusting it made an untagged working copy claim to be the previous release:

gitrespect 0.4.1+dirty     # wrong: this tree is newer than v0.4.1

Presence of a vcs.revision build setting distinguishes the two cases. Local builds keep reporting dev, and now also carry the VCS revision and commit time instead of none / unknown.

Result

Build	Before	After
goreleaser release	0.5.0 + commit	unchanged
go install ...@latest	dev	0.5.0
local go build	dev	dev + revision

Tests

First tests for internal/cmd: four cases covering version resolution (proxy install, local checkout, goreleaser-stamped, (devel)), plus coverage of the output flag validation added in #4.

go build, go vet, go test, gofmt -l all clean.