Golden-file tests for command construction

Several packages have no tests at all — `internal/cli`, `deploy`, `backup`, `bootstrap`, `provider`, `toolchain`, `ui` are all at 0%. The reason is that they mostly build shell commands and run them over SSH, which looks untestable without a VM. It is not. The command *string* is the contract, and it can be asserted directly. **Scope** Golden-file tests that pin the exact command each operation builds, so a change that alters behaviour shows up as a diff in review rather than as a broken deployment. **Why this matters more than the coverage number** Every bug this tool has had in production was in this layer: - `--sudo` was bound to a flag but never assigned, so it read as false and updates ran unelevated. Go does not catch it — the variable *is* used, by the flag binding. - Image references were read from `ps` instead of `compose config`, which on a host that resolved a tag to a digest gave a bare `sha256` with no name, so rollback would have failed at the exact moment it was needed. - A stack mixing registry images with locally built ones could not be pulled at all, because compose fails the whole command on the first unpullable image. All three passed review and failed only against a real Docker daemon. `internal/compose/regressions_test.go` pins those three; this issue is about extending that approach to the packages that still have nothing.