Add mlf status and mlf diff read-only commands

Introduce mlf-cli/src/remote_state.rs, a shared pipeline that walks the workspace, generates Lexicon JSON for every module, wraps each as a com.atproto.lexicon.schema record, computes its DAG-CBOR CID, and fetches whatever's currently published on the PDS. classify() sorts every NSID into Unchanged/New/Changed/Removed; remote records outside [package].name are left alone so shared-account-per-package setups don't get stepped on. mlf status renders the summary plus per-authority DNS readiness; mlf diff prints unified JSON diffs via the similar crate for any NSID the status would touch. Also fixes a spec-compliance gap in mlf-atproto::identity: per the ATProto lexicon spec, an NSID's publishing authority is the NSID minus the final name segment (so com.example.forum.post and com.example.forum.thread share _lexicon.forum.example.com). authority_of_nsid + authority_dns_name + RealDnsResolver::resolve_authority_did implement the correct drop-final rule used by the new status/diff path; the fetcher's existing helpers are kept unchanged for backwards compatibility.