chore(test,docs): add make test, CI, e2e container, refresh example

- Makefile gains `test` and `test-e2e` targets; `deps` now installs the
  dev extras so pytest is available after `make deps`.
- .github/workflows/test.yml runs unit tests on push and PR to main
  (Python 3.13 on ubuntu-latest, ignores tests/e2e by default).
- tests/e2e/Containerfile + test_dotfiles_e2e.py scaffold a real
  container-based smoke test of `flow dotfiles init` + `link` against
  the example dotfiles repo. Gated by FLOW_RUN_E2E=1 so unit runs
  stay fast; verified locally with podman.
- tests/fakes.FakeRunner uses ordered subsequence matching instead of
  unordered containment -- prevents accidental match between unrelated
  commands that happen to share tokens.
- example/README.md rewritten for the current command surface
  (no more `dotfiles undo`, `dotfiles modules ...`, `--relink`,
  `bootstrap list/show/run --profile`, `bootstrap packages --resolved`).
  Adds an "External modules" section documenting `_module.yaml`.
- example/dotfiles-repo profiles.yaml drops `allow-sudo: true` along
  with the runtime support.
- pyproject.toml adds [tool.coverage] config.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/e2e/Containerfile

@@ -0,0 +1,37 @@
+# Containerfile for end-to-end testing of the flow CLI.
+#
+# Builds a minimal Debian image with python + git, copies the flow source in,
+# installs it via pip, and creates a non-root user (flow refuses to run as root).
+#
+# Build context expected to be the flow-cli repo root. Example:
+#   podman build -f tests/e2e/Containerfile -t flow-e2e .
+#
+FROM debian:bookworm-slim
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        git \
+        python3 \
+        python3-venv \
+        python3-pip \
+        sudo \
+        ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create a non-root user; flow refuses to run as uid 0.
+RUN useradd --create-home --shell /bin/bash flowuser \
+    && echo "flowuser ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
+# Copy the flow source and install it for the non-root user.
+WORKDIR /opt/flow-src
+COPY --chown=flowuser:flowuser . /opt/flow-src
+
+USER flowuser
+ENV PATH="/home/flowuser/.local/bin:${PATH}"
+
+RUN pip3 install --user --break-system-packages -e /opt/flow-src
+
+WORKDIR /home/flowuser
+ENTRYPOINT ["/bin/bash"]