fix(debugger): extract MarteController into an importable controller package

Client/debugger was entirely package main, which Go forbids importing from
another module ("is a program, not an importable package") -- discovered
while wiring the new debugclient E2E tool against NewHeadlessMarteController.
Move martecontrol.go and its test into a new marte2debugger/controller
subpackage (package controller) and update Client/debugger/main.go to call
controller.NewMarteController/controller.DangerousCommandsEnabled. No
behavioral change to the browser-facing server.

Client/debugger/controller/cmd_gate_test.go

@@ -0,0 +1,54 @@
+package controller
+
+import (
+	"testing"
+)
+
+// TestIsDangerousCommand_Force — FORCE is dangerous.
+func TestIsDangerousCommand_Force(t *testing.T) {
+	if !isDangerousCommand("FORCE signal 1.0") {
+		t.Error("FORCE should be dangerous")
+	}
+}
+
+// TestIsDangerousCommand_Pause — PAUSE is dangerous.
+func TestIsDangerousCommand_Pause(t *testing.T) {
+	if !isDangerousCommand("PAUSE") {
+		t.Error("PAUSE should be dangerous")
+	}
+}
+
+// TestIsDangerousCommand_Msg — MSG is dangerous.
+func TestIsDangerousCommand_Msg(t *testing.T) {
+	if !isDangerousCommand("MSG target func") {
+		t.Error("MSG should be dangerous")
+	}
+}
+
+// TestIsDangerousCommand_CaseInsensitive — case-insensitive.
+func TestIsDangerousCommand_CaseInsensitive(t *testing.T) {
+	if !isDangerousCommand("force signal 1.0") {
+		t.Error("lowercase force should be dangerous")
+	}
+}
+
+// TestIsDangerousCommand_SafeCommand — DISCOVER is not dangerous.
+func TestIsDangerousCommand_SafeCommand(t *testing.T) {
+	if isDangerousCommand("DISCOVER") {
+		t.Error("DISCOVER should not be dangerous")
+	}
+}
+
+// TestIsDangerousCommand_TraceNotDangerous — TRACE is not dangerous (read-only).
+func TestIsDangerousCommand_TraceNotDangerous(t *testing.T) {
+	if isDangerousCommand("TRACE signal 1") {
+		t.Error("TRACE should not be dangerous")
+	}
+}
+
+// TestIsDangerousCommand_Empty — empty command is not dangerous.
+func TestIsDangerousCommand_Empty(t *testing.T) {
+	if isDangerousCommand("") {
+		t.Error("empty command should not be dangerous")
+	}
+}