test: expand bats coverage across installer modules

Added unit tests for `disk.sh`, `btrfs.sh`, the archangel monolith's `gather_input` unattended branch, and filled gap cases in `config.sh`. The suite grew from 71 to 110 tests.

`installer/lib/disk.sh` was completely uncovered. New `tests/unit/test_disk.bats` covers the four pure partition-path helpers (`get_efi_partition`, `get_root_partition`, `get_efi_partitions`, `get_root_partitions`) across SATA, virtio, and NVMe inputs, mixed arrays, and the empty-input behavior. Side-effecting functions in the same file (sgdisk, mkfs.fat, partprobe, and fzf wrappers) stay deliberately VM-tested.

`installer/lib/btrfs.sh` had no bats coverage. New `tests/unit/test_btrfs.bats` covers `get_luks_devices`, the only pure helper in the file. It pins the asymmetric naming convention where the first device gets the bare `LUKS_MAPPER_NAME` and subsequent devices append the index.

The archangel monolith was un-source-able for tests because its top-level code created a /tmp log file and redirected stdout via `exec > >(tee...)`, plus called `main "$@"` unconditionally at the bottom. I extracted the logging setup into an `init_logging` function called from `main`, and wrapped the main call in a `[[ "${BASH_SOURCE[0]}" == "${0}" ]]` guard. Sourcing the script now loads function definitions silently, with no log file and no banner. Running it directly works exactly as before. Verified both paths.

That refactor unlocks `tests/unit/test_archangel.bats`, which covers `gather_input` in unattended mode. Required-field validation for HOSTNAME, TIMEZONE, ROOT_PASSWORD, and DISKS. Optional-field defaulting (FILESYSTEM to zfs, LOCALE to en_US.UTF-8, KEYMAP to us, ENABLE_SSH to yes). Filesystem-specific encryption checks (ZFS_PASSPHRASE required when not NO_ENCRYPT, same for LUKS_PASSPHRASE on Btrfs). Filesystem validity. RAID_LEVEL defaulting for multi-disk installs. The interactive branch stays out of scope per the testing-strategy policy.

`tests/unit/test_config.bats` got five gap tests: `check_config` when CONFIG_FILE is set, `validate_config` against a non-block-device entry (e.g. /dev/null) and a missing path, and `parse_args` accepting `--color` and `--config-file` together in either order.

`testing-strategy.org` got an expanded "What bats does NOT cover" section. The doc previously named six tools (mkfs, cryptsetup, zpool create, pacstrap, arch-chroot, grub-install). The new list adds sgdisk, partprobe, blkid, mkfs.fat, mkfs.btrfs, snapper, efibootmgr, mount, umount, findmnt, mountpoint, and fzf. It also names the conditions (root needed, real /dev or /sys state) that make a function VM-only. The coverage table at the top now lists the three new test files.

No behavior change in production code. The init_logging extraction preserves the existing log path and banner format byte-for-byte.

1 files changed, 31 insertions, 5 deletions

diff --git a/testing-strategy.org b/testing-strategy.org
index 4b948fd..0f81a3a 100644
--- a/testing-strategy.org
+++ b/testing-strategy.org
@@ -61,16 +61,42 @@ Current coverage lives in =tests/unit/=:
 
 | File | What it covers |
 |------+----------------|
-| =test_common.bats= | =command_exists=, =require_command=, =info=/=warn=/=error=, =enable_color=, =log=, =prompt_password=, =pacstrap_packages= |
+| =test_common.bats= | =command_exists=, =require_command=, =info=/=warn=/=error=, =enable_color=, =log=, =prompt_password=, =pacstrap_packages=, =install_dropin= |
 | =test_config.bats= | =parse_args=, =load_config=, =validate_config=, =check_config= |
 | =test_raid.bats= | =raid_valid_levels_for_count=, =raid_is_valid=, =raid_usable_bytes=, =raid_fault_tolerance= |
+| =test_disk.bats= | =get_efi_partition=, =get_root_partition=, =get_efi_partitions=, =get_root_partitions= |
+| =test_btrfs.bats= | =get_luks_devices= |
+| =test_archangel.bats= | =gather_input= (unattended branch only) |
 
 ** What bats does NOT cover (deliberately)
 
-Anything that shells out to =mkfs=, =cryptsetup=, =zpool create=,
-=pacstrap=, =arch-chroot=, =grub-install=, or needs root. Those behaviors
-only mean anything against real partitions on real (virtual) hardware and
-belong in the VM integration tests below.
+Anything that shells out to a tool whose behavior only means something
+against real partitions, real hardware, or root privileges. Those
+behaviors belong in the VM integration tests below.
+
+The full list of deliberately-skipped tools and conditions:
+
+- *Filesystem creation*: =mkfs.fat=, =mkfs.btrfs=, =mkfs.ext4=, generic =mkfs=
+- *Encryption*: =cryptsetup= (LUKS), ZFS native encryption via =zfs create -O encryption=
+- *ZFS pool / dataset operations*: =zpool create=, =zpool import=, =zfs create=, =zfs snapshot=, =zfs rollback=
+- *Partitioning*: =sgdisk=, =partprobe=, =blkid=
+- *Bootstrap and chroot*: =pacstrap=, =arch-chroot=, =genfstab=
+- *Bootloader*: =grub-install=, =grub-mkconfig=, =efibootmgr=
+- *Snapshot management*: =snapper=, =zfs-pre-snapshot=
+- *Mount / unmount of real filesystems*: =mount=, =umount=, =findmnt=,
+  =mountpoint=
+- *Interactive UI*: =fzf= (the helper-fallback path is also skipped because
+  the value is in the user-facing flow)
+- Anything that needs =root= privileges to do its real work
+- Anything that depends on real =/dev= or =/sys= state (=lsblk= against
+  actual disks, =/sys/block/= holders)
+
+Pure helpers adjacent to these tools — ones that compute values
+without invoking the tool — are in scope for bats. =pacstrap_packages=
+is the canonical example: it builds the package list that =pacstrap=
+will install, but doesn't run pacstrap itself, so it's covered by
+=test_common.bats=. Same pattern when a future helper parses a captured
+fixture of a tool's output instead of running the tool live.
 
 ** Running