Extend bootstrap_test.go with FullFlow_IdempotentReRun (two
sequential bootstraps on the same fake SSH server — verifies the
idempotent no-op path end-to-end), FullFlow_NoPasswordInLogs
(asserts the SSH password never appears in slog output, D-031),
FullFlow_ValidateSudoersFails (forceSudoersInvalid flag →
wrapped 'validate sudoers' error), FullFlow_CreateLinuxUserFails
(ProxmoxUser=root exercises the /root home branch in deployPubKey),
DefaultSSHDialer_DialContext_ConnectionRefused (covers the real
defaultSSHDialer.DialContext concrete path), and
SSHSessionRunner_CombinedOutput_NewSessionError (closed-client →
'new session' error branch). Add forceSudoersInvalid knob +
funcDialer helper to ssh_session_test.go.
Coverage: 83.2% → 87.1%. go test -race PASS. No production code
changed (T01.1 sessionRunner seam already in place).
---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
Jon Chery