feat: implement system preflight checks and health diagnostics

Introduced a tiered system verification mechanism to improve reliability
and provide actionable feedback to users, avoiding false positives in
the critical execution path.

Key changes:
- Implement `CheckSystemRequirements` for critical, non-ambiguous
  requirements (e.g., TUN device availability) to ensure fatal
  environment issues are caught immediately during bootstrap.
- Implement a user-facing `healthcheck` command that provides
  comprehensive diagnostics and actionable configuration hints for
  common misconfigurations (e.g., unprivileged user namespaces,
  subuid/subgid mappings, and kernel sysctls).
- Refactor the `FileSystem` interface to support full mockability,
  allowing for exhaustive unit testing of diagnostic logic.
- Add comprehensive unit tests in `internal/namespace/preflight_test.go`
  covering various Linux distributions, privilege levels, and
  hardware availability scenarios.
- Ensure code quality through formatting, static analysis (golangci-lint),
  and validation of all existing unit, integration, and E2E tests.

1 files changed, 8 insertions, 0 deletions

diff --git a/internal/wireguard/wireguard_unit_test.go b/internal/wireguard/wireguard_unit_test.go
index 1ad7f65..9fbe6b0 100644
--- a/internal/wireguard/wireguard_unit_test.go
+++ b/internal/wireguard/wireguard_unit_test.go
@@ -71,6 +71,14 @@ func (m *mockFS) MkdirTemp(dir, pattern string) (string, error) {
 	return res, nil
 }
 
+func (m *mockFS) ReadFile(name string) ([]byte, error) {
+	return os.ReadFile(m.fullPath(name))
+}
+
+func (m *mockFS) Open(name string) (*os.File, error) {
+	return os.Open(m.fullPath(name))
+}
+
 func (m *mockFS) Remove(name string) error {
 	// If the path is absolute and starts with our root, we can remove it directly.
 	// Otherwise, we use fullPath to ensure it's within root.