test(cli): move tests/ out of tools/, separate marmot vs dm

`tools/` is for libraries (arti-build); shell-based interop harnesses
that drive the `amy` binary belong with the CLI module. New layout:

  cli/tests/
  ├── lib.sh                       # shared logging + result tracking
  ├── headless/helpers.sh          # shared amy_a / amy_json / assertions
  ├── marmot/                      # MLS group-messaging interop (vs whitenoise-rs)
  │   ├── marmot-interop.sh
  │   ├── marmot-interop-headless.sh
  │   ├── setup.sh
  │   ├── tests-create.sh
  │   ├── tests-manage.sh
  │   ├── tests-extras.sh
  │   └── patches/
  └── dm/                          # NIP-17 DM interop (amy ↔ amy)
      ├── dm-interop-headless.sh
      ├── setup.sh
      └── tests-dm.sh

Per-suite changes:
- Each suite owns its own setup.sh; previously the Marmot setup was at
  headless/setup.sh and the DM setup at headless/setup-dm.sh, which
  implied shared infra they don't actually share.
- `cli/tests/lib.sh` and `cli/tests/headless/helpers.sh` are the only
  shared bits across suites.
- The DM harness still reuses Marmot's `start_local_relay` /
  `stop_local_relay` (sourced via `../marmot/setup.sh`) — same relay
  binary, no duplication.
- All sourcing paths updated; REPO_ROOT now climbs three levels (was
  two when the harness lived under `tools/`); patches/ is now a sibling
  of marmot/setup.sh rather than under marmot/headless/.
- `.gitignore` updated to cover both suites' state dirs.

cli/ROADMAP.md and cli/tests/README.md updated to point at the new paths.
No behavioural change — every test runs the same code; only the file
layout and source paths moved.

cli/tests/marmot/patches/whitenoise-mock-keyring.patch

@@ -0,0 +1,18 @@
+--- a/src/bin/wnd.rs
++++ b/src/bin/wnd.rs
+@@ -22,6 +22,15 @@
+     let args = Args::parse();
+     let config = Config::resolve(args.data_dir.as_ref(), args.logs_dir.as_ref());
+
++    // marmot-interop-headless patch: allow sandboxes/CI without a real
++    // kernel keyring to fall back to the integration-tests mock keyring
++    // by setting $WHITENOISE_MOCK_KEYRING=1. Requires the daemon to be
++    // built with --features cli,integration-tests. No effect otherwise.
++    #[cfg(feature = "integration-tests")]
++    if std::env::var("WHITENOISE_MOCK_KEYRING").is_ok() {
++        Whitenoise::initialize_mock_keyring_store();
++    }
++
+     let wn_config = WhitenoiseConfig::new(&config.data_dir, &config.logs_dir, KEYRING_SERVICE_ID);
+     Whitenoise::initialize_whitenoise(wn_config).await?;
+