seams: move the last four package globals onto instance fields

Three test seams were still package-level mutable vars, which tests
had to swap before use. That's the classic path to flaky parallel
tests — two goroutines fighting over the same global fake. Push each
down to the struct that owns the behaviour.

internal/daemon/dns_routing.go
  lookupExecutableFunc + vmDNSAddrFunc → fields on *HostNetwork,
  defaulted at newHostNetwork time. dns_routing_test builds
  HostNetwork{..., lookupExecutable: stub, vmDNSAddr: stub} inline,
  no more t.Cleanup dance around package-level vars.

internal/daemon/preflight.go + doctor.go
  vsockHostDevicePath (mutable string) → vsockHostDevice field on
  *VMService, defaulted via defaultVsockHostDevice constant in
  newVMService. Preflight reads s.vsockHostDevice; doctor reads
  d.vm.vsockHostDevice. Logger test sets d.vm.vsockHostDevice = tmp
  after wireServices.

internal/daemon/workspace/workspace.go
  HostCommandOutputFunc → *Inspector struct with a Runner field.
  Every git-using helper (GitOutput, GitTrimmedOutput,
  GitResolvedConfigValue, RunHostCommand, ListSubmodules,
  ListOverlayPaths, CountUntrackedPaths, InspectRepo,
  ImportRepoToGuest, PrepareRepoCopy) is now a method on *Inspector.
  NewInspector() wraps the real host runner for production;
  WorkspaceService holds one via repoInspector, CLI deps holds one
  too. cli_test.go's submodule-rejection test builds its own
  Inspector with a scripted Runner instead of patching a global.
  Pure helpers (FinalizeScript, ResolveSourcePath, ParsePrepareMode,
  ShellQuote, FormatStepError, GitFileURL, ParseNullSeparatedOutput)
  stay free functions since they don't touch the host.

Sentinel: grep for HostCommandOutputFunc, lookupExecutableFunc,
vmDNSAddrFunc, vsockHostDevicePath is now empty across internal/.
make lint test green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/cli/deps.go

@@ -12,6 +12,7 @@ import (
 
 	"banger/internal/api"
 	"banger/internal/daemon"
+	"banger/internal/daemon/workspace"
 	"banger/internal/guest"
 	"banger/internal/paths"
 	"banger/internal/rpc"
@@ -52,6 +53,12 @@ type deps struct {
 	buildVMRunToolingPlan func(ctx context.Context, repoRoot string) toolingplan.Plan
 	cwd                   func() (string, error)
 	completionLister      func(ctx context.Context, socketPath, method string) ([]string, error)
+	// repoInspector is the CLI's single workspace-package Inspector.
+	// Every code path that needs to shell out to git on the host
+	// (preflight, dry-run, untracked-count note) goes through it, so
+	// tests inject a stub Runner via this field instead of mutating a
+	// package global.
+	repoInspector *workspace.Inspector
 }
 
 func defaultDeps() *deps {
@@ -127,5 +134,6 @@ func defaultDeps() *deps {
 		buildVMRunToolingPlan: toolingplan.Build,
 		cwd:                   os.Getwd,
 		completionLister:      defaultCompletionLister,
+		repoInspector:         workspace.NewInspector(),
 	}
 }