feat: add static flow inspect command

[tbrandenburg]

Issue

Closes #46

Summary

• Add a static, read-only inspect command for inventory and bounded graph output, using the existing flow-file resolver.
• Traverse ordinary wires, cross-tab Link relationships, static/dynamic Link Calls, junctions, and instance-qualified local subflows; include warnings for malformed or unresolved topology.
• Add deterministic text/JSON rendering, focused fixtures and tests, and README usage/limitations.
• Inspection does not start Node-RED, execute Function code, or claim runtime reachability/return behavior.

Validation

• npm run format — passed.
• npm run lint — passed.
• npm test — passed (132 tests, 0 failed).
• make ci — format, lint, and tests passed; npm audit reports the existing 15 vulnerabilities (9 moderate, 6 high).
• make install-global followed by global CLI checks — passed for help, inventory/JSON, tab filtering, depth validation, cross-tab Link/subflow topology, nested Link Call, and after-return continuation.
• Integration test confirms inspect creates no Node-RED runtime files in the isolated HOME.

E2E coverage

Used the actual globally installed node-red-cli against test/fixtures/native-cross-tab.flows.json; validated inventory and JSON, tab scope, depth 0/deeper traversal, cross-tab Link edges, subflow expansion, nested Link Call, and rejection of invalid depth forms. The global install was restored to the original checkout after testing.

Risks / follow-ups

• This feature crosses graph identity and nested subflow boundary semantics; dedicated unit tests cover instance qualification, nested subflows, passthrough, cycles, and disabled-state propagation.
• No unrelated issues were found.