test(sys): invariant test suite for lib/sys + Arch.parse/goarch extraction

[markovejnovic]

Summary

Closes the real test gaps in lib/sys with invariant-driven tests (plan: docs/superpowers/plans/2026-07-07-sys-test-suite.md), plus three small refactors that expose pure functions so logic buried behind fixed system paths becomes property-testable:

• Sys.Arch — extracted pure parse/1; absorbed goarch/1 from Hyper.Img.OciLoader (it is an architecture fact, not an OCI-loader fact). New inverse law: parse(goarch(a)) == {:ok, a}.
• Sys.Linux.Proc.Mounts — extracted parse/1 (mirrors Meminfo.parse/1); property pins the keep-valid/skip-garbage/preserve-order law; live smoke asserts / is always mounted.
• Sys.Linux.Subid — promoted private subid_ranges/1 to public ranges/1 (body unchanged); properties pin the security-relevant whole-file refusal: one malformed line anywhere refuses the entire file.
• Sys.Posix — real-filesystem tests: exec-bit table + the four distinct refusal paths of ensure_writable_dir/1 (root-exempt cases self-skip under uid 0).
• Sys.Tmp — with_tempdir/2 lifecycle, incl. the load-bearing cleanup-on-raise contract.
• Sys.Linux.Nss / Meminfo — live passwd round-trip (uid 0 exists on every Linux), getent refusal contract, short-line skip branch.
• Sys.Mon — live monitor-stack contract: readings/0 answers for all four metrics; forced real samples through /proc + /sys assert domain invariants (CPU fraction clamped to 0..1, positive used memory, non-negative bandwidth).

Coverage triage per CLAUDE.md: mechanical error-propagation arms and environment-surgery paths are deliberately declined, recorded in the plan's "Declined coverage" section.

Test plan

• mix test test/sys — 123/123 (49 properties, 74 tests), no Postgres/Firecracker needed
• Full gate green: format, compile --warnings-as-errors, credo --strict, dialyzer 0
• Per-task review incl. mutation testing (4 injected Sys.Posix bugs all caught) and 5x flake runs on the live mon tests

[codecov]

Codecov Report

❌ Patch coverage is 81.81818% with 2 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
lib/sys/arch.ex	66.66%	1 Missing ⚠️
lib/sys/linux/proc/mounts.ex	80.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[github-actions]

Test Results

  4 files  ± 0  177 suites  +14   1m 41s ⏱️ +5s
507 tests +36  502 ✅ +31    0 💤 ± 0  5 ❌ +5 
870 runs  +72  502 ✅ +31  363 💤 +36  5 ❌ +5 

For more details on these failures, see this check.

Results for commit 051829b. ± Comparison against base commit 5b5068f.