root-ubuntu: cover configure_sensors with tests

[ralyodio]

configure_sensors was the one step in root-ubuntu.sh with no test coverage, which mattered more than usual because the function is deliberately not the one-liner it looks like. Three of its behaviours existed only as comments:

• the VM guard — systemd-detect-virt keeps sensors-detect off guests, which are never shown the host's thermal hardware. Without it every Droplet run writes an empty config that reads like a failed detection rather than like a machine with nothing to detect.
• the i2c-dev modprobe — sensors-detect finds SMBus chips through /dev/i2c-*, which do not exist until the module is loaded, and --auto takes the default answer to that prompt, which is no.
• the re-check afterwards — sensors-detect exits 0 on a machine with no supported chips, so its status alone is not evidence. The honest signal is a temp*_input appearing under /sys/class/hwmon.

Also covered: the warn-but-return-0 path, so a failed probe never aborts provisioning, and one assertion tying the halves together (lm-sensors in BASE_PACKAGES, the step wired into the apt run) — a detection step is dead code if the package never lands, and the package is dead weight if nothing probes.

How it runs

Following the existing configure_swap pattern: the six commands the function reaches the machine through (command -v, systemd-detect-virt, compgen -G, modprobe, sensors-detect, systemctl) are shadowed, so the real body executes and the tests still cannot touch the box they run on. HWMON stands in for "/sys/class/hwmon has a reading in it" and the sensors-detect stub flips it, which is what makes the post-detection re-check a real assertion instead of a restatement of the stub's return code.

Verification

pnpm test — 600 passed across 26 files, 7 of them new.

Mutation-checked rather than assumed: neutering the VM guard fails the VM test alone, and dropping the modprobe line fails the i2c-dev test alone. root-ubuntu.sh itself is unchanged in this branch.

pnpm typecheck fails on two pre-existing exactOptionalPropertyTypes errors in src/free-names.ts, present at master's tip and untouched here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GFdGuLQcpyGhsKzbU4voLK

[github-actions]

ThreatCrush Security Scan

16 finding(s)

HIGH/CRITICAL: 5 | MEDIUM: 2 | LOW: 9

Severity	Rule	Location
HIGH	sh-remote-script-execution	root-ubuntu.sh:139
HIGH	sh-remote-script-execution	root-ubuntu.sh:2816
HIGH	sh-remote-script-execution	root-ubuntu.sh:2820
HIGH	sh-remote-script-execution	root-ubuntu.sh:2969
HIGH	sh-remote-script-execution	root-ubuntu.sh:3998
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
MEDIUM	redos-nested-quantifier	src/porkbun.ts:506
LOW	secret-generic-credential	src/credentials.ts:36
LOW	insecure-temp-file	test/blog.test.ts:73
LOW	insecure-temp-file	test/blog.test.ts:74
LOW	insecure-temp-file	test/credentials.test.ts:43
LOW	insecure-temp-file	test/credentials.test.ts:44
LOW	secret-generic-api-key	test/credentials.test.ts:208
LOW	insecure-temp-file	test/download.test.ts:99
LOW	insecure-temp-file	test/download.test.ts:100
LOW	secret-generic-credential	test/shorten.test.ts:36

Snippets are redacted; ThreatCrush never prints matched credential material.