chore(test,docs): add make test, CI, e2e container, refresh example

- Makefile gains `test` and `test-e2e` targets; `deps` now installs the
  dev extras so pytest is available after `make deps`.
- .github/workflows/test.yml runs unit tests on push and PR to main
  (Python 3.13 on ubuntu-latest, ignores tests/e2e by default).
- tests/e2e/Containerfile + test_dotfiles_e2e.py scaffold a real
  container-based smoke test of `flow dotfiles init` + `link` against
  the example dotfiles repo. Gated by FLOW_RUN_E2E=1 so unit runs
  stay fast; verified locally with podman.
- tests/fakes.FakeRunner uses ordered subsequence matching instead of
  unordered containment -- prevents accidental match between unrelated
  commands that happen to share tokens.
- example/README.md rewritten for the current command surface
  (no more `dotfiles undo`, `dotfiles modules ...`, `--relink`,
  `bootstrap list/show/run --profile`, `bootstrap packages --resolved`).
  Adds an "External modules" section documenting `_module.yaml`.
- example/dotfiles-repo profiles.yaml drops `allow-sudo: true` along
  with the runtime support.
- pyproject.toml adds [tool.coverage] config.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/fakes.py

@@ -11,9 +11,11 @@ from flow.core.runtime import CommandRunner
 class FakeRunner(CommandRunner):
     """CommandRunner that captures calls instead of executing.
 
-    Response matching uses keyword containment: a response keyed by
-    ``("ps", "{{.Names}}")`` matches any command whose argv contains
-    both ``"ps"`` and ``"{{.Names}}"``.
+    Response matching uses ordered subsequence semantics: a response keyed by
+    ``("ps", "{{.Names}}")`` matches any command whose argv contains those
+    tokens in that order (other tokens may appear before, between, or after).
+    This is stricter than set containment -- ``("a", "b")`` does NOT match
+    ``["b", "a"]`` -- and matches argv semantics more accurately.
     """
 
     def __init__(self, responses: dict[tuple[str, ...], Any] | None = None):
@@ -21,12 +23,17 @@ class FakeRunner(CommandRunner):
         self.timeouts: list[float | None] = []
         self._responses: dict[tuple[str, ...], Any] = responses or {}
 
+    @staticmethod
+    def _match(parts: list[str], key: tuple[str, ...]) -> bool:
+        it = iter(parts)
+        return all(k in it for k in key)
+
     def run(self, argv, *, cwd=None, env=None, capture_output=True, check=False, timeout=None):
         parts = list(argv)
         self.calls.append(parts)
         self.timeouts.append(timeout)
         for key, resp in self._responses.items():
-            if all(k in parts for k in key):
+            if self._match(parts, key):
                 return resp
         return subprocess.CompletedProcess(parts, 0, stdout="", stderr="")