Adds an unimplemented Format([]byte) ([]byte, error) stub and a
64-subtest suite across 12 groups pinning down the behavior contract:
classification, sorting, preamble, line endings, blank lines,
comments, whitespace, passthrough, deduplication, errors, edge cases,
and a kitchen-sink integration case. Idempotence is checked on every
passing case. Tests default to Qt 6 style (no version) with a few
cases kept versioned to cover both styles.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

qml.Format now takes Options{LibraryPrefixes, ModulePrefixes};
prefixes let callers promote bare names to library or demote dotted
names to module, with precedence ahead of the default heuristics.
Adds contract tests for the override behavior and for 12 validation
rules (empty, leading dot, Qt/qt start, "pragma", overlaps within
and across lists). Prefixes are trimmed before validation and use.
Stub still returns "not implemented".

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Updates the CLI and internal-API design docs to reflect the Options
struct added in the previous commit: new --library-prefix and
--module-prefix flags with precedence, trim, and validation rules
(empty, leading dot, Qt/qt start, "pragma", within-list and cross-
list overlaps). INTERNAL_API.md now threads qml.Options through the
fs helper signatures and shows it in the per-mode composition table.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Wrap qml.Format with the file and stream operations the CLI needs.
In-place writes go via temp-file-then-rename so a crash mid-write
can't truncate the original, and the write is skipped entirely when
formatting would not change content. The directory walk filters
.qml, skips dotfile paths, and refuses to follow symlinks so the
tool can be pointed at a tree root without scanning .git or
descending into linked dependencies.

Parse flags, compile the classifier once at startup so a bad
prefix surfaces as a usage error before any file is touched,
and dispatch one of --stdin, --stdout, --check, or in-place
write modes through the fs layer. Per-file failures log to
stderr and the run continues; exit 0 on clean, 1 only when
--check finds changes, 2 on usage or I/O failure. The --check
stdout writes are guarded so a closed pipe (e.g. piped to
head) bails out cleanly instead of looping over the tree.