Make runRebootRemediation testable via dependency injection; add coverage

[Copilot]

runRebootRemediation hard-coded systemd.New() and exec.CommandContext internally, making it untestable without a live systemd. Addresses the review feedback on #131.

Changes

pkg/drift/remediation.go

• Introduces rebootCommandRunner func type for the exec dependency
• Adds defaultRebootRunner wrapping exec.CommandContext (annotated #nosec G204)
• Extracts runRebootRemediationWithDeps(ctx, logger, mgr systemd.Manager, runner rebootCommandRunner) — the injectable, testable core
• runRebootRemediation becomes a one-liner wrapper providing the real deps:

  func runRebootRemediation(ctx context.Context, logger *logrus.Logger) error {
      return runRebootRemediationWithDeps(ctx, logger, systemd.New(), defaultRebootRunner)
  }

• Renames local status → unitStatus to avoid shadowing the status package

pkg/drift/remediation_test.go

• Adds stubSystemdManager (full systemd.Manager implementation) and stubRebootRunner test doubles
• Adds table-driven TestRunRebootRemediationWithDeps with 6 parallel subtests:

  Subtest	Expected behaviour
  unit-not-found/no-op	ErrUnitNotFound → nil, runner not called
  inactive/no-op	inactive state → nil, runner not called
  active/executes-reboot	active state → runner called, nil error
  get-unit-status-error/surfaced	non-ErrUnitNotFound error → wrapped and returned
  reboot-command-fails/surfaced	runner error → wrapped and returned
  reboot-command-times-out/surfaced	expired-deadline context → "timed out" path exercised

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.