Inject the incus command, so the enumeration tests fail incus on every machine

The tests set MESH_LAB_INCUS in their body, which runs after the client module has read it, so they
asked the real incus: green where none is installed, red on the workstation that runs the lab.

src/incus/client.ts

@@ -20,7 +20,24 @@ import { around, log, shorten } from "../log.ts";
  * predates the group grant cannot reach it — which is a real thing that happens on the
  * machine that just installed it.
  */
-const INCUS = (process.env["MESH_LAB_INCUS"] ?? "incus").split(" ").filter(Boolean);
+let INCUS = (process.env["MESH_LAB_INCUS"] ?? "incus").split(" ").filter(Boolean);
+
+/**
+ * Point every call at another program, and say what it was pointed at before.
+ *
+ * **For a test about how the lab reads a failure, never about the hypervisor.** The command was
+ * read from `MESH_LAB_INCUS` once, when this module loaded — and a test file setting that variable
+ * in its body set it too late, because an ES module's imports are evaluated before its body. So the
+ * enumeration tests asked the real incus wherever one was installed and reachable: they passed on a
+ * machine without incus (the spawn fails) and failed on the workstation that runs the lab, where
+ * listing succeeds. Injected here, a test names the failing program and gets it, on every machine.
+ */
+export function useIncusCommand(argv: string[]): string[] {
+  if (argv.length === 0 || !argv[0]) throw new Error("an incus command needs a program to run");
+  const was = INCUS;
+  INCUS = [...argv];
+  return was;
+}
 
 export interface IncusResult {
   stdout: string;