Guard the layout, and stop probing before every command

[siliconwitch]

Go refuses an import cycle, not one part importing another, so the rule the
layout exists for rested on discipline alone: fleet importing device builds,
vets and tests clean. A test now walks internal and fails on any import the
graph in cli.md does not allow. Nothing bound a test to the command table
either, so deleting a wired command, or leaving one without its Run, passed the
whole suite. One test pins the set that carries a Run, and another renders the
real table rather than the synthetic one dispatch tests against. Each guard was
checked against the violation it exists to catch, with the import made real
enough to compile.

api.CheckServer sent GET / before all twenty implemented commands, threw the
response away, and returned the same sentence every request site already
returns on a failed Do. It bought a round trip for a message the real request
produces a moment later, and it could not tell reachable from too old because
it read neither the status nor X-Min-Version. It also put a network call in the
router, so every dispatch test had to stand up a listener for cases like -h and
--version that never touch the network; that test now imports no network
package at all.

account delete keeps a check of its own, written where it runs rather than
behind a shared function with one caller. It is the only command that puts a
question before it acts, so it is the only one the probe did any good for.
Being authenticated, it also tells someone who is not logged in before the
question rather than after it.

Measured against a stub: fleet list made GET / then GET /fleets and now makes
only GET /fleets, key list makes its two real requests, and account delete is
alone in making GET / first.

No version change, and nothing under .github, flake.nix, .goreleaser.yaml or
go.mod is touched.