fix(duo): make glab duo help GitLab Duo CLI centric

Rewrites glab duo help to point at the GitLab Duo CLI, adds an install-aware getting-started footer on glab duo cli --help, and positions glab duo as a group command — not a passthrough to the binary.

Fixes the bug report: the old help advertised glab duo <command> prompt [--flags] and described glab duo ask, so users on a clean machine got the binary's too many arguments error when they followed the help.

Behavior

Command	Result
glab duo	help output, exit 0
glab duo <anything>	unknown command "<anything>" for "glab duo". The GitLab Duo CLI runs as "glab duo cli". Try "glab duo cli <anything>", or run "glab duo cli --help" for the full command reference.
glab duo cli	interactive Duo CLI session
glab duo cli run --goal "…"	headless mode
glab duo cli --help	rewritten help + GITLAB DUO CLI footer showing binary status
glab duo ask …	dispatched to the (hidden) ask command as before

FParseErrWhitelist.UnknownFlags = true keeps flag-bearing invocations (glab duo run --goal foo) on the redirect path instead of a generic "unknown flag" error.

glab duo cli --help footer

Binary installed:

GITLAB DUO CLI
  Installed: 9.5.0 (/Users/…/glab-cli/bin/duo)
  Run 'glab duo cli help' for the GitLab Duo CLI commands and flags.

Binary not installed:

GITLAB DUO CLI
  The GitLab Duo CLI binary is not installed yet. To get started:

    1. glab auth login          # authenticate, once
    2. glab duo cli --install   # download the GitLab Duo CLI binary
    3. glab duo cli             # start an interactive session

Path resolution goes through cfg.Get("", "duo_cli_binary_path") — same as binarymgr.Runner.

Notes

• glab duo ask is kept as a hidden subcommand; the earlier plan to remove it in 19.3 has been reversed.
• Docs at docs.gitlab.com only mention glab duo cli --update, not --install, which this help now recommends. Worth a follow-up in gitlab-org/gitlab.
• New unit tests in internal/commands/duo/duo_test.go guard: no DisableFlagParsing, bare shows help, unknown subcommand redirects, subcommands still dispatch.