Three hosts: arch, alpine and android

ADR 0060, built. `make hosts` produces mesh-host-arch, mesh-host-alpine and
mesh-host-android, each pinned to its system at link time.

The claim that "almost all of it is shared" held up. All 36 existing apply
tests pass unchanged -- the only edit was naming which system they run against,
which was previously implicit. What moved into internal/system is two appliers'
worth of code and the probes that go with them.

Each system's differences are real and needed re-deriving rather than
translating:

apk reports absence by EMPTY OUTPUT and exits zero either way, where pacman
exits non-zero. Reading apk's exit code the way pacman's is read reports every
package as installed. That is the single most dangerous difference between the
two and it is invisible until it bites.

OpenRC has no LoadState, so "the service does not exist" is read from its prose
rather than a field. Same distinction, different evidence -- and this is exactly
what an interface spanning both would have had to drop, which is why 0060
rejected one.

OpenRC has no is-enabled either. Boot state comes from the runlevel listing:
"does it start at boot" becomes "does it appear in rc-update show default".

Android is a partial host and that is the point. It implements file, directory
and action -- the shapes needing only a filesystem and a way to run something --
and refuses the other three by name, before anything is applied. Its unreachable
appliers return ErrUnsupported rather than a zero value, so "unreachable" fails
loudly if it stops being true.

A host also confirms it is on the machine it was built for, once, at the start.
The alpine host on this Arch machine says "this machine is not Alpine" instead
of failing later inside a package manager that is not there. And a host built
without -X main.builtFor refuses everything, naming the hosts that exist.

Two test problems found by injecting faults. One injection did not compile, so
the check now reports that separately from a pass. The other passed with the
behaviour removed: the missing-service assertion matched "does not exist", which
the FALL-THROUGH error also contains because it echoes the raw output. It now
asserts the diagnosis, which only the correct branch produces.

Verified with the real binaries: android refuses a package naming what it does
support; alpine on Arch refuses the machine; arch applies and is idempotent; a
system-less build refuses everything.

cmd/mesh-host/main.go

@@ -24,11 +24,17 @@ import (
 	"github.com/novox/mesh-host/internal/inventory"
 	"github.com/novox/mesh-host/internal/profile"
 	"github.com/novox/mesh-host/internal/store"
+	"github.com/novox/mesh-host/internal/system"
 	"github.com/novox/mesh-host/internal/upgrade"
 )
 
 // version is stamped at build time. Unset in a development build, and said so rather than
 // defaulted to something that looks like a release.
+// builtFor names the operating system this host was built for, set at link time
+// (novox/hq ADR 0060). A host built without one refuses to do anything that touches the
+// machine, rather than guessing and calling a package manager that is not there.
+var builtFor = ""
+
 var version = "development build"
 
 const usage = `mesh-host — the node host
@@ -295,7 +301,23 @@ func runApply(ctx context.Context, opts options, d *declaration.Declaration, sou
 		return nil
 	}
 
-	report, updated, applyErr := apply.Apply(ctx, d, known, apply.ExecRunner, func(line string) {
+	sys, err := system.For(builtFor)
+	if err != nil {
+		return err
+	}
+	// Refuse a declaration naming a shape this host cannot apply, before anything is applied.
+	// An android host has no `package` applier, and finding that out half way through is the
+	// half-configured machine this host exists to prevent (novox/hq ADR 0060).
+	if err := system.Check(sys, d); err != nil {
+		return err
+	}
+	// And prove this is the machine the host was built for. Installing the arch host on Alpine
+	// must say so once, at the start, rather than failing later inside pacman.
+	if err := sys.Confirm(ctx, apply.ExecRunner); err != nil {
+		return err
+	}
+
+	report, updated, applyErr := apply.Apply(ctx, sys, d, known, apply.ExecRunner, func(line string) {
 		if !opts.json {
 			fmt.Println(line)
 		}