[quality] test: BATS coverage for the k8s recipe in files/os/justfile (new tests/unit/os-justfile_test.bats)

[kubestellar-hive]

Claimed ground

• New file: tests/unit/os-justfile_test.bats (test-only; no production file is modified)
• Unit under test: the k8s recipe in files/os/justfile — sysext acquisition, /etc/rancher/k3s/config.yaml seeding, token handling, sysext merge, server/agent/invalid role dispatch, failure propagation
• Tracker cluster: server unit-test coverage ([quality] No CI workflow runs unit tests — tests/unit/ would land untested by CI #42 — no CI runs tests/unit/)

Disjoint from every open server PR: #41 covers files/installer/repart.d, #38 covers files/bin/system-container, #30 covers .github/scripts/docs-checks.py, #40/#34 are architect element/CI refactors, #36 is sysupdate keying. #37 edits files/os/justfile itself (the write-kubeconfig-mode value); this PR adds no change to that file and deliberately asserts only that a write-kubeconfig-mode: key is seeded, never its value, so it does not conflict with #37 either way.

Test Improvement

20 BATS cases. Each invocation runs inside an unprivileged user + mount namespace with tmpfs masks over /etc and /var/lib; systemctl, systemd-sysext and systemd-sysupdate are logging stubs on PATH. No host state is touched, no unit is enabled, no OTA is fetched. The suite skips cleanly where namespaces or just are unavailable.

Covered:

• missing vs. present /var/lib/extensions/k3s.raw → sysupdate is or is not invoked
• a failing systemd-sysupdate does not abort the recipe (|| true)
• fresh host seeds config.yaml; existing config.yaml is never overwritten
• token argument written as a quoted token: line; empty/absent token writes none
• systemd-sysext.service enabled and systemd-sysext merge run; merge failure tolerated
• server / agent / default / unknown / wrong-case role dispatch
• unknown role exits 1, names the supported roles, and enables no k3s unit
• a failing systemctl enable --now k3s.service fails the recipe

Defect surfaced

The parse gate fails on the current tree — that failure is the finding, filed as #44:

error: Recipe line has inconsistent leading whitespace.
       Recipe started with `␠␠␠␠␠␠␠␠` but found line with `␠␠␠␠`
  ——▶ files/os/justfile:32:1

The cat <<EOF body inside the recipe sits at column 0, which resets justs recipe indentation and makes the closing fi inconsistent. Reproduced identically on just 1.14.0, 1.25.2, 1.36.0, 1.40.0 and 1.42.4 — just k8s has never been runnable on a shipped image.

Quality does not patch production code, so this PR ships tests only. The 18 behavioural cases skip while the justfile is unparseable, so the suite reports exactly one failure instead of twenty derived ones. All 20 were verified green against a locally patched, parseable copy of the recipe; they flip from skip to real coverage the moment #44 is fixed.

Related Issues

Refs #44
Refs #42

---

Filed by quality agent (hold-gated mode). Human review required. Do not merge without addressing #44.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.78

[castrojo]

Addressed and merged via 7a44c3f with the k8s recipe parse fix.