refactor: fail loud, tighten types, remove speculative abstraction

Fail loud at the boundary:
- substitute_template raises ConfigError on unresolved {{...}}; no more
  silent literal placeholders in download URLs.
- parse_profile raises ConfigError when 'os' is missing -- no
  raw.get("os", "linux") default that silently masks typos.
- urllib download failures wrapped to FlowError.
- bootstrap _execute_action dispatches phases explicitly and raises
  on unhandled phase; no more "anything else runs as shell".

Direct access over defensive wrapping:
- plan_bootstrap requires env; plan_install requires pm. Drop the
  dead `or os.environ` / `or detect_package_manager()` fallbacks.
- InstalledState.from_dict raises ConfigError on missing fields
  rather than .get(..., default).
- Replace `x or {}` chains with explicit `x if x is not None else {}`
  in package resolution; catalog validates type/platform-map/install
  shapes at parse.

One canonical form / direct access:
- Path.home() replaced with paths.HOME in services/packages.py and
  commands/completion.py. paths.HOME is the single source now.
- Use Path.is_relative_to for install-path containment instead of
  str.startswith.

Domain purity:
- domain/containers/resolution.resolve_mounts takes a filesystem_check
  predicate; service passes the probe in. Domain no longer touches
  the filesystem directly.

No speculative abstraction:
- Drop the `allow_sudo` field entirely. The _script_uses_sudo check
  it gated was bypassable (substring match) and gave false confidence;
  the manifest is fully user-trusted anyway.
- Delete dead terminfo_fix_command + RemoteService.fix_terminfo
  (no command surface exposes them).
- FileSystem.remove_tree no longer swallows errors via ignore_errors;
  callers opt into missing_ok if needed.

Typed enums:
- PackageDef.type, AppConfig.container_runtime as Literal[...].
  container_runtime values validated at config parse.

Completion bypasses runtime no longer:
- complete(ctx, ...) threads context; ContainerRuntime and state-file
  reads go through ctx.runtime instead of constructing primitives.

Tests added for: template raise, missing os raise, env/pm required,
unknown phase raise, no allow_sudo gate, URL download failure, install
path escape, corrupt installed.json, container_runtime Literal,
filesystem_check controls mounts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_service_bootstrap.py

@@ -83,7 +83,6 @@ class TestBootstrapService:
                     "os": "linux",
                     "packages": [{
                         "name": "docker",
-                        "allow-sudo": True,
                         "post-install": "sudo groupadd docker || true",
                     }],
                 },
@@ -93,9 +92,27 @@ class TestBootstrapService:
         ctx = _make_ctx(manifest)
         BootstrapService(ctx).run("linux-auto")
 
-        assert captured["packages"][0].allow_sudo is True
         assert captured["packages"][0].post_install == "sudo groupadd docker || true"
 
+    def test_unknown_phase_raises(self):
+        from flow.domain.bootstrap.models import BootstrapAction, BootstrapPlan
+        from flow.domain.bootstrap.models import VALID_PHASES
+
+        manifest = {"profiles": {"work": {"os": "linux"}}}
+        ctx = _make_ctx(manifest)
+        svc = BootstrapService(ctx)
+        # Forge an action with a phase that VALID_PHASES contains but the
+        # dispatch can't handle (shouldn't happen, but tests the explicit guard).
+        # Use a phase NOT in VALID_PHASES first to confirm the "Unknown" branch.
+        action = BootstrapAction.__new__(BootstrapAction)
+        object.__setattr__(action, "phase", "no-such-phase")
+        object.__setattr__(action, "description", "")
+        object.__setattr__(action, "commands", ())
+        object.__setattr__(action, "needs_sudo", False)
+        plan = BootstrapPlan(profile="work", actions=(), packages_to_install=())
+        with pytest.raises(FlowError, match="Unknown bootstrap phase"):
+            svc._execute_action(action, plan, "work")
+
     def test_run_uses_dotfiles_profile_override(self, monkeypatch):
         captured = {}