refactor: decouple namespace operations and improve test coverage

- Introduce `namespace.Ops` interface to decouple `Manager` from system-level namespace operations, enabling easier unit testing via mocks.
- Add unit tests for `internal/paths` to verify path resolution logic across different environment configurations.
- Implement `EnsureBinary` helper in E2E tests to gracefully skip tests when `WG_WRAP_BIN` is not set, allowing `go test ./...` to pass in non-build environments.
- Apply project-wide formatting and fix linting issues.

13 files changed, 31 insertions, 74 deletions

diff --git a/tests/e2e/arg_integrity_test.go b/tests/e2e/arg_integrity_test.go
index 497a51d..daace7e 100644
--- a/tests/e2e/arg_integrity_test.go
+++ b/tests/e2e/arg_integrity_test.go
@@ -20,10 +20,7 @@ func TestArgumentIntegrity(t *testing.T) {
 
 	for _, payload := range payloads {
 		t.Run(fmt.Sprintf("Payload_%s", payload), func(t *testing.T) {
-			binaryPath, err := GetBinaryPath()
-			if err != nil {
-				t.Skip("Skipping E2E test: wg-wrap binary not found (WG_WRAP_BIN not set)")
-			}
+			binaryPath := EnsureBinary(t)
 			cmd := exec.Command(binaryPath, "test-args", payload)
 			out, err := cmd.CombinedOutput()
 			if err != nil {
diff --git a/tests/e2e/config_hotswap_test.go b/tests/e2e/config_hotswap_test.go
index a962b97..54155a0 100644
--- a/tests/e2e/config_hotswap_test.go
+++ b/tests/e2e/config_hotswap_test.go
@@ -13,10 +13,7 @@ import (
 // does not affect an active session. A process joining an existing session
 // should use the established tunnel's state, not the updated file.
 func TestConfigHotSwap(t *testing.T) {
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	tmpRuntimeDir := t.TempDir()
 	tmpConfigDir := t.TempDir()
diff --git a/tests/e2e/config_test.go b/tests/e2e/config_test.go
index c8749ce..33eb6e6 100644
--- a/tests/e2e/config_test.go
+++ b/tests/e2e/config_test.go
@@ -10,10 +10,7 @@ import (
 )
 
 func TestConfigPropagation(t *testing.T) {
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	tmpConfigDir := t.TempDir()
 	tmpRuntimeDir := t.TempDir()
diff --git a/tests/e2e/crash_recovery_test.go b/tests/e2e/crash_recovery_test.go
index 669f25f..11d6ca3 100644
--- a/tests/e2e/crash_recovery_test.go
+++ b/tests/e2e/crash_recovery_test.go
@@ -12,10 +12,7 @@ import (
 // TestCrashRecovery verifies that wg-wrap can recover from a "dirty" state
 // where a previous run crashed, leaving behind stale PID and pin files.
 func TestCrashRecovery(t *testing.T) {
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	tmpRuntimeDir := t.TempDir()
 	tmpConfigDir := t.TempDir()
diff --git a/tests/e2e/e2e_test.go b/tests/e2e/e2e_test.go
index 939d231..907bb22 100644
--- a/tests/e2e/e2e_test.go
+++ b/tests/e2e/e2e_test.go
@@ -13,10 +13,7 @@ import (
 
 func TestDataPlaneConnectivity(t *testing.T) {
 	// 1. Determine binary path
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	// 2. Setup isolated config & runtime folders for testing
 	tmpDir := t.TempDir()
@@ -78,10 +75,7 @@ AllowedIPs = 10.0.0.0/24
 		}
 	}()
 
-	err = cmd.Run()
-	// We expect the command (ping) to fail because our mock peer does not complete
-	// the handshake or reply to pings, but we log the error for diagnostic purposes.
-	if err != nil {
+	if err := cmd.Run(); err != nil {
 		t.Logf("wg-wrap command returned error (expected since mock peer doesn't reply): %v", err)
 	}
 
@@ -100,10 +94,7 @@ AllowedIPs = 10.0.0.0/24
 }
 
 func TestNetworkIsolation(t *testing.T) {
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	cmd := exec.Command(binaryPath, "test-ns")
 	out, err := cmd.CombinedOutput()
@@ -117,10 +108,7 @@ func TestNetworkIsolation(t *testing.T) {
 }
 
 func TestDNSIsolation(t *testing.T) {
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	// 1. Start Mock DNS Server
 	dnsServer, port := StartMockDNSServer(t)
@@ -190,10 +178,7 @@ AllowedIPs = 10.0.0.0/24
 }
 
 func TestDNSPrecedence(t *testing.T) {
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	tmpDir := t.TempDir()
 	profileName := "test-dns-precedence"
@@ -276,10 +261,7 @@ AllowedIPs = 10.0.0.0/24
 }
 
 func TestMTUFragmentation(t *testing.T) {
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	cmd := exec.Command(binaryPath, "--profile", "default", "--", "true")
 	if err := cmd.Run(); err != nil {
@@ -288,14 +270,11 @@ func TestMTUFragmentation(t *testing.T) {
 }
 
 func TestExitCodePropagation(t *testing.T) {
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	// Run a command that exits with code 42
 	cmd := exec.Command(binaryPath, "--profile", "default", "--", "sh", "-c", "exit 42")
-	err = cmd.Run()
+	err := cmd.Run()
 	if err == nil {
 		t.Fatalf("expected command to fail with exit status 42, but it succeeded")
 	}
diff --git a/tests/e2e/fuzz_args_test.go b/tests/e2e/fuzz_args_test.go
index 0d71e0e..1007f32 100644
--- a/tests/e2e/fuzz_args_test.go
+++ b/tests/e2e/fuzz_args_test.go
@@ -15,10 +15,7 @@ func FuzzArgumentIntegrity(f *testing.F) {
 	f.Add("\x00null\x00")
 
 	f.Fuzz(func(t *testing.T, payload string) {
-		binaryPath, err := GetBinaryPath()
-		if err != nil {
-			t.Skip("Skipping E2E fuzz test: wg-wrap binary not found (WG_WRAP_BIN not set)")
-		}
+		binaryPath := EnsureBinary(t)
 
 		out, err := exec.Command(binaryPath, "test-args", payload).CombinedOutput()
 
diff --git a/tests/e2e/lifecycle_test.go b/tests/e2e/lifecycle_test.go
index ffd731f..d0d7271 100644
--- a/tests/e2e/lifecycle_test.go
+++ b/tests/e2e/lifecycle_test.go
@@ -62,10 +62,7 @@ func waitForLifecycle(t *testing.T, binaryPath, runtimeDir, profile string, expe
 
 func TestNamespaceLifecycleAutomation(t *testing.T) {
 	// 1. Setup Environment
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	// 2. Override the runtime base dir to a temporary location
 	tmpRuntimeDir := t.TempDir()
diff --git a/tests/e2e/mount_leak_test.go b/tests/e2e/mount_leak_test.go
index 428675f..e3fe071 100644
--- a/tests/e2e/mount_leak_test.go
+++ b/tests/e2e/mount_leak_test.go
@@ -13,10 +13,7 @@ import (
 // TestDNSMountLeak verifies that /etc/resolv.conf bind mounts are cleaned up
 // after a profile is stopped.
 func TestDNSMountLeak(t *testing.T) {
-	bin, err := GetBinaryPath()
-	if err != nil {
-		t.Fatal(err)
-	}
+	bin := EnsureBinary(t)
 
 	profile := "leak-test"
 	dnsServer := "8.8.8.8"
diff --git a/tests/e2e/network_change_test.go b/tests/e2e/network_change_test.go
index fb75e02..f1ca215 100644
--- a/tests/e2e/network_change_test.go
+++ b/tests/e2e/network_change_test.go
@@ -14,10 +14,7 @@ import (
 // Since we can't easily toggle physical hardware in CI, we verify that the
 // userspace WireGuard engine can handle connectivity interruptions.
 func TestHostNetworkChange(t *testing.T) {
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	tmpRuntimeDir := t.TempDir()
 	tmpConfigDir := t.TempDir()
diff --git a/tests/e2e/resource_exhaustion_test.go b/tests/e2e/resource_exhaustion_test.go
index 3e60cdb..b5cdaf9 100644
--- a/tests/e2e/resource_exhaustion_test.go
+++ b/tests/e2e/resource_exhaustion_test.go
@@ -11,10 +11,7 @@ import (
 // TestResourceExhaustion ensures that repeatedly starting and stopping
 // tunnels does not leak mounts, file descriptors, or namespaces.
 func TestResourceExhaustion(t *testing.T) {
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	tmpRuntimeDir := t.TempDir()
 	tmpConfigDir := t.TempDir()
diff --git a/tests/e2e/sharing_test.go b/tests/e2e/sharing_test.go
index b0971f9..1ecfbe6 100644
--- a/tests/e2e/sharing_test.go
+++ b/tests/e2e/sharing_test.go
@@ -11,10 +11,7 @@ import (
 )
 
 func TestNamespaceSharing(t *testing.T) {
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	tmpRuntimeDir := t.TempDir()
 	tmpConfigDir := t.TempDir()
diff --git a/tests/e2e/test_helpers.go b/tests/e2e/test_helpers.go
index 6d65011..93e851c 100644
--- a/tests/e2e/test_helpers.go
+++ b/tests/e2e/test_helpers.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"strings"
+	"testing"
 )
 
 // GetBinaryPath resolves the path to the wg-wrap binary.
@@ -21,6 +22,16 @@ func GetBinaryPath() (string, error) {
 	return path, nil
 }
 
+// EnsureBinary returns the path to the wg-wrap binary or skips the test if it's not available.
+func EnsureBinary(t *testing.T) string {
+	t.Helper()
+	bin, err := GetBinaryPath()
+	if err != nil {
+		t.Skipf("skipping test: %v", err)
+	}
+	return bin
+}
+
 // SetEnvOverrides returns a new slice of environment variables with the provided overrides applied.
 // It ensures that overriding an existing variable replaces it rather than appending it.
 func SetEnvOverrides(overrides map[string]string) []string {
diff --git a/tests/e2e/vulnerability_test.go b/tests/e2e/vulnerability_test.go
index 8de38a3..26536fe 100644
--- a/tests/e2e/vulnerability_test.go
+++ b/tests/e2e/vulnerability_test.go
@@ -56,10 +56,7 @@ func TestDNSLeak(t *testing.T) {
 		t.Skip("Skipping DNS leak test in short mode")
 	}
 
-	binaryPath, err := GetBinaryPath()
-	if err != nil {
-		t.Skipf("Skipping test: %v", err)
-	}
+	binaryPath := EnsureBinary(t)
 
 	// 1. Setup a profile with a fake, unreachable DNS server.
 	tmpConfigDir := t.TempDir()
@@ -83,7 +80,7 @@ PublicKey = 0000000000000000000000000000000000000000000000000000000000000000
 AllowedIPs = 0.0.0.0/0
 Endpoint = 1.1.1.1:51820
 `
-	err = os.WriteFile(profilePath, []byte(conf), 0644)
+	err := os.WriteFile(profilePath, []byte(conf), 0644)
 	if err != nil {
 		t.Fatal(err)
 	}