feat: add VM-based E2E testing with Tart

Add comprehensive end-to-end test suite using disposable Tart macOS VMs.
Tests cover the full user journey from bare macOS to configured dev
environment, validating real system state rather than just command output.

Infrastructure:
- testutil/tartvm.go: VM lifecycle management (clone, boot, SSH, expect, destroy)
- Three-tier Makefile targets: test-vm-quick (5min), test-vm-release (20min), test-vm-full (60min)
- Cirrus CI config for cloud-based parallel VM testing

Test coverage (48 test functions):
- 9 user journey tests (first-time install, dry-run safety, snapshot accuracy,
  diff consistency, idempotency, packages-only, manual uninstall recovery,
  full setup, error messages)
- 10 edge case tests (snapshot import/restore, clean removal, cask verification,
  npm packages, shell functionality, remote config, developer preset,
  post-install scripts, version upgrade compatibility, partial failure recovery)
- 13 command tests (every command and flag)
- 6 interactive tests (expect-based TUI simulation)
- 4 install flow tests + 4 lifecycle tests + 1 infra test

Discovered and fixed 3 bugs via these tests (see previous commit).

Author: fullstackjam

.cirrus.yml

@@ -0,0 +1,84 @@
+# Cirrus CI — VM-based E2E tests using Tart (native macOS virtualization)
+#
+# Cirrus CI runs on Apple Silicon and supports Tart natively, enabling
+# parallel macOS VM tests that aren't possible on GitHub Actions.
+#
+# Trigger: manual dispatch or release tags.
+# For PR testing, use GitHub Actions (unit + integration tests).
+
+env:
+  HOMEBREW_NO_AUTO_UPDATE: 1
+  HOMEBREW_NO_INSTALL_CLEANUP: 1
+
+# =============================================================================
+# L2: Release validation — runs on every tag push
+# =============================================================================
+release_validation_task:
+  name: "E2E Release Validation"
+  only_if: $CIRRUS_TAG != '' || $CIRRUS_BRANCH == 'main'
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-sequoia-base:latest
+  install_deps_script:
+    - eval "$(/opt/homebrew/bin/brew shellenv)"
+    - brew install go sshpass hudochenkov/sshpass/sshpass cirruslabs/cli/tart
+  build_script:
+    - eval "$(/opt/homebrew/bin/brew shellenv)"
+    - make build
+  test_script:
+    - eval "$(/opt/homebrew/bin/brew shellenv)"
+    - make test-vm-release
+  timeout_in: 45m
+
+# =============================================================================
+# L3: Full validation — manual trigger or release tags
+# =============================================================================
+# Split into parallel tasks to maximize throughput.
+# Each task runs a subset of tests in its own VM.
+
+full_journey_task:
+  name: "E2E Journey Tests"
+  trigger_type: manual
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-sequoia-base:latest
+  install_deps_script:
+    - eval "$(/opt/homebrew/bin/brew shellenv)"
+    - brew install go sshpass hudochenkov/sshpass/sshpass cirruslabs/cli/tart
+  build_script:
+    - eval "$(/opt/homebrew/bin/brew shellenv)"
+    - make build
+  test_script:
+    - eval "$(/opt/homebrew/bin/brew shellenv)"
+    - go test -v -timeout 60m -tags="e2e,vm" -run "TestVM_Journey" ./test/e2e/...
+  timeout_in: 90m
+
+full_edge_cases_task:
+  name: "E2E Edge Case Tests"
+  trigger_type: manual
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-sequoia-base:latest
+  install_deps_script:
+    - eval "$(/opt/homebrew/bin/brew shellenv)"
+    - brew install go sshpass hudochenkov/sshpass/sshpass cirruslabs/cli/tart
+  build_script:
+    - eval "$(/opt/homebrew/bin/brew shellenv)"
+    - make build
+  test_script:
+    - eval "$(/opt/homebrew/bin/brew shellenv)"
+    - go test -v -timeout 60m -tags="e2e,vm" -run "TestVM_Edge" ./test/e2e/...
+  timeout_in: 90m
+
+full_commands_task:
+  name: "E2E Command + Interactive Tests"
+  trigger_type: manual
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-sequoia-base:latest
+  install_deps_script:
+    - eval "$(/opt/homebrew/bin/brew shellenv)"
+    - brew install go sshpass hudochenkov/sshpass/sshpass cirruslabs/cli/tart
+  build_script:
+    - eval "$(/opt/homebrew/bin/brew shellenv)"
+    - make build
+  test_script:
+    - eval "$(/opt/homebrew/bin/brew shellenv)"
+    - go test -v -timeout 60m -tags="e2e,vm" -run "TestVM_Cmd|TestVM_Install|TestVM_Interactive|TestVM_Lifecycle" ./test/e2e/...
+  timeout_in: 90m

Makefile

@@ -1,4 +1,5 @@
-.PHONY: test-unit test-integration test-e2e test-destructive test-smoke test-smoke-prebuilt test-coverage test-all
+.PHONY: test-unit test-integration test-e2e test-destructive test-smoke test-smoke-prebuilt test-coverage test-all \
+       test-vm test-vm-short test-vm-run test-vm-quick test-vm-release test-vm-full
 
 BINARY_NAME=openboot
 BINARY_PATH=./$(BINARY_NAME)
@@ -38,6 +39,36 @@ test-all:
 	-$(MAKE) test-e2e
 	$(MAKE) test-coverage
 
+# =============================================================================
+# VM-based E2E tests (Tart VMs) — three levels
+# =============================================================================
+
+# L1: Quick validation (~5min) — run after code changes
+#     Uses -short flag: skips tests that install real packages
+test-vm-quick: build
+	go test -v -timeout 10m -tags="e2e,vm" -short ./test/e2e/...
+
+# L2: Release validation (~20min) — run before tagging a release
+#     Core user journeys: dry-run safety, install + verify, diff/clean cycle,
+#     manual uninstall recovery, full setup, error messages
+test-vm-release: build
+	go test -v -timeout 30m -tags="e2e,vm" \
+	  -run "TestVM_Infra|TestVM_Journey_DryRun|TestVM_Journey_FirstTimeUser|TestVM_Journey_ManualUninstall|TestVM_Journey_DiffConsistency|TestVM_Journey_FullSetup|TestVM_Journey_ErrorMessages" \
+	  ./test/e2e/...
+
+# L3: Full validation (~60min) — run for major releases or CI
+#     All 48 tests: journeys + edge cases + commands + interactive
+test-vm-full: build
+	go test -v -timeout 90m -tags="e2e,vm" ./test/e2e/...
+
+# Aliases
+test-vm: test-vm-release
+test-vm-short: test-vm-quick
+
+# Single VM test by name (e.g. make test-vm-run TEST=TestVM_Journey_DryRun)
+test-vm-run: build
+	go test -v -timeout 45m -tags="e2e,vm" -run $(TEST) ./test/e2e/...
+
 build:
 	go build -ldflags="$(LDFLAGS)" -o $(BINARY_PATH) ./cmd/openboot