smoke: cover -d/--detach and bootstrap NAT precondition

Two new pure scenarios:

* detach_run: -d --rm and -d -- <cmd> combos rejected before VM
  creation; bare -d leaves the VM running and ssh-able afterward.

* bootstrap_precondition: workspace with a .mise.toml is refused
  without --nat; --no-bootstrap bypasses the precondition and the
  run completes normally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/smoke.sh

@@ -66,6 +66,8 @@ SMOKE_SCENARIOS=(
   include_untracked
   workspace_export
   concurrent_run
+  detach_run
+  bootstrap_precondition
   vm_lifecycle
   vm_set
   vm_restart
@@ -97,6 +99,8 @@ declare -A SMOKE_DESCS=(
   [include_untracked]="--include-untracked ships files outside the git index"
   [workspace_export]="workspace export round-trip: guest edit -> patch marker"
   [concurrent_run]="two parallel --rm invocations both succeed"
+  [detach_run]="vm run -d: --rm/--cmd combos rejected; -d leaves VM running and ssh-able"
+  [bootstrap_precondition]="workspace with .mise.toml refused without --nat; --no-bootstrap bypasses"
   [vm_lifecycle]="explicit create / stop / start / ssh / delete"
   [vm_set]="reconfigure vcpu while stopped; guest sees new count"
   [vm_restart]="restart verb: boot_id changes"
@@ -128,6 +132,8 @@ declare -A SMOKE_CLASS=(
   [include_untracked]=repodir
   [workspace_export]=repodir
   [concurrent_run]=pure
+  [detach_run]=pure
+  [bootstrap_precondition]=pure
   [vm_lifecycle]=pure
   [vm_set]=pure
   [vm_restart]=pure
@@ -516,6 +522,72 @@ scenario_concurrent_run() {
   grep -q 'smoke-concurrent-b' "$tmpB" || die "concurrent VM B missing marker: $(cat "$tmpB")"
 }
 
+scenario_detach_run() {
+  log "${SMOKE_DESCS[detach_run]}"
+  local rc
+
+  set +e
+  "$BANGER" vm run -d --rm 2>/dev/null
+  rc=$?
+  set -e
+  [[ "$rc" -ne 0 ]] || die "detach: -d --rm should be rejected before VM creation"
+
+  set +e
+  "$BANGER" vm run -d -- echo hi 2>/dev/null
+  rc=$?
+  set -e
+  [[ "$rc" -ne 0 ]] || die "detach: -d -- <cmd> should be rejected before VM creation"
+
+  local detach_name=smoke-detach
+  "$BANGER" vm run -d --name "$detach_name" >/dev/null \
+    || die "detach: vm run -d --name $detach_name failed"
+
+  local show_out
+  show_out="$("$BANGER" vm show "$detach_name")" \
+    || die "detach: vm show after -d failed"
+  grep -q '"state": "running"' <<<"$show_out" \
+    || die "detach: VM not running after -d: $show_out"
+
+  local ssh_out
+  ssh_out="$("$BANGER" vm ssh "$detach_name" -- echo detach-marker)" \
+    || die "detach: post-detach ssh failed"
+  grep -q 'detach-marker' <<<"$ssh_out" \
+    || die "detach: ssh missing marker: $ssh_out"
+
+  "$BANGER" vm delete "$detach_name" >/dev/null \
+    || die "detach: cleanup vm delete failed"
+}
+
+scenario_bootstrap_precondition() {
+  log "${SMOKE_DESCS[bootstrap_precondition]}"
+  local mise_repo="$runtime_dir/smoke-mise-repo"
+  rm -rf "$mise_repo"
+  mkdir -p "$mise_repo"
+  (
+    cd "$mise_repo"
+    git init -q
+    git -c user.email=smoke@banger -c user.name=smoke commit --allow-empty -q -m init
+    printf '[tools]\n' > .mise.toml
+    git add .mise.toml
+    git -c user.email=smoke@banger -c user.name=smoke commit -q -m 'add mise'
+  )
+
+  local rc
+  set +e
+  "$BANGER" vm run --rm "$mise_repo" -- echo nope 2>/dev/null
+  rc=$?
+  set -e
+  [[ "$rc" -ne 0 ]] || die "bootstrap: workspace with .mise.toml should refuse without --nat / --no-bootstrap"
+
+  local nb_out
+  nb_out="$("$BANGER" vm run --rm --no-bootstrap "$mise_repo" -- echo no-bootstrap-ok)" \
+    || die "bootstrap: --no-bootstrap should bypass NAT precondition"
+  grep -q 'no-bootstrap-ok' <<<"$nb_out" \
+    || die "bootstrap: --no-bootstrap output missing marker: $nb_out"
+
+  rm -rf "$mise_repo"
+}
+
 scenario_vm_lifecycle() {
   log "${SMOKE_DESCS[vm_lifecycle]}"
   local lifecycle_name=smoke-lifecycle