seams: move the last four package globals onto instance fields

Three test seams were still package-level mutable vars, which tests
had to swap before use. That's the classic path to flaky parallel
tests — two goroutines fighting over the same global fake. Push each
down to the struct that owns the behaviour.

internal/daemon/dns_routing.go
  lookupExecutableFunc + vmDNSAddrFunc → fields on *HostNetwork,
  defaulted at newHostNetwork time. dns_routing_test builds
  HostNetwork{..., lookupExecutable: stub, vmDNSAddr: stub} inline,
  no more t.Cleanup dance around package-level vars.

internal/daemon/preflight.go + doctor.go
  vsockHostDevicePath (mutable string) → vsockHostDevice field on
  *VMService, defaulted via defaultVsockHostDevice constant in
  newVMService. Preflight reads s.vsockHostDevice; doctor reads
  d.vm.vsockHostDevice. Logger test sets d.vm.vsockHostDevice = tmp
  after wireServices.

internal/daemon/workspace/workspace.go
  HostCommandOutputFunc → *Inspector struct with a Runner field.
  Every git-using helper (GitOutput, GitTrimmedOutput,
  GitResolvedConfigValue, RunHostCommand, ListSubmodules,
  ListOverlayPaths, CountUntrackedPaths, InspectRepo,
  ImportRepoToGuest, PrepareRepoCopy) is now a method on *Inspector.
  NewInspector() wraps the real host runner for production;
  WorkspaceService holds one via repoInspector, CLI deps holds one
  too. cli_test.go's submodule-rejection test builds its own
  Inspector with a scripted Runner instead of patching a global.
  Pure helpers (FinalizeScript, ResolveSourcePath, ParsePrepareMode,
  ShellQuote, FormatStepError, GitFileURL, ParseNullSeparatedOutput)
  stay free functions since they don't touch the host.

Sentinel: grep for HostCommandOutputFunc, lookupExecutableFunc,
vmDNSAddrFunc, vsockHostDevicePath is now empty across internal/.
make lint test green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/cli/cli_test.go

@@ -1116,27 +1116,28 @@ func TestVMRunPreflightRejectsSubmodules(t *testing.T) {
 	d := defaultDeps()
 	repoRoot := t.TempDir()
 
-	origHostCommandOutput := workspace.HostCommandOutputFunc
-	t.Cleanup(func() {
-		workspace.HostCommandOutputFunc = origHostCommandOutput
-	})
-
-	workspace.HostCommandOutputFunc = func(ctx context.Context, name string, args ...string) ([]byte, error) {
-		t.Helper()
-		if name != "git" {
-			t.Fatalf("command = %q, want git", name)
-		}
-		switch {
-		case reflect.DeepEqual(args, []string{"-C", repoRoot, "rev-parse", "--show-toplevel"}):
-			return []byte(repoRoot + "\n"), nil
-		case reflect.DeepEqual(args, []string{"-C", repoRoot, "rev-parse", "--is-bare-repository"}):
-			return []byte("false\n"), nil
-		case reflect.DeepEqual(args, []string{"-C", repoRoot, "ls-files", "--stage", "-z"}):
-			return []byte("160000 deadbeef 0\tvendor/submodule\x00"), nil
-		default:
-			t.Fatalf("unexpected git args: %v", args)
-			return nil, nil
-		}
+	// Stub the CLI's repo-inspector with a scripted runner. Per-deps
+	// injection means this test no longer mutates any package global,
+	// so t.Parallel() is safe to add here in the future without
+	// worrying about racing another test's fake runner.
+	d.repoInspector = &workspace.Inspector{
+		Runner: func(ctx context.Context, name string, args ...string) ([]byte, error) {
+			t.Helper()
+			if name != "git" {
+				t.Fatalf("command = %q, want git", name)
+			}
+			switch {
+			case reflect.DeepEqual(args, []string{"-C", repoRoot, "rev-parse", "--show-toplevel"}):
+				return []byte(repoRoot + "\n"), nil
+			case reflect.DeepEqual(args, []string{"-C", repoRoot, "rev-parse", "--is-bare-repository"}):
+				return []byte("false\n"), nil
+			case reflect.DeepEqual(args, []string{"-C", repoRoot, "ls-files", "--stage", "-z"}):
+				return []byte("160000 deadbeef 0\tvendor/submodule\x00"), nil
+			default:
+				t.Fatalf("unexpected git args: %v", args)
+				return nil, nil
+			}
+		},
 	}
 
 	_, err := d.vmRunPreflightRepo(context.Background(), repoRoot)