fix(installer): run the network-FS guard before the log dir is created

[LukasWodka]

Summary

The NFS/root-squash guard is good — but it fires aftersetup_log_file has already mkdir'd HOST_DATA_DIR and redirected the session's output onto it. On the exact machine the guard exists for (NFS home, sudo, root_squash), the install dies on a bare mkdir error — or leaves a squashed/nobody-owned log dir — before the guard's friendly, named failure can print.

Change

• _pf_is_network_fstype — the filesystem classification extracted from _pf_storage_type (shared, single list; the full check's user-visible strings are byte-identical).
• early_data_dir_guard — runs right after validate_config, beforesetup_log_file: silent on local/undetermined filesystems, refuses network filesystems with the named fix (HOST_DATA_DIR=/local/path), and defers to the full preflight warning when TRACEBLOC_ALLOW_NETWORK_FS=1.
• Call is declare -F-guarded (same stale-bootstrap pattern as the assess/host_audit gates).
• 6 new bats tests incl. an ordering gate (guard line must precede setup_log_file in main()); manifest.sha256 regenerated.

Independent of the #437→#440 stack (different manifest lines) — mergeable in any order relative to it.

Type

Bug fix

Test plan

Full bats suite green locally (incl. copy catalog — no golden drift); bash -n + shellcheck --severity=error clean; gen-manifest.sh --check clean.

🤖 Generated with Claude Code

---

Note

Low Risk
Installer-only ordering and messaging change with regression tests; no runtime cluster or auth behavior changes.

Overview
Moves the NFS/network-home failure earlier so users see a clear refusal instead of a bare mkdir error or a root-squashed log dir when setup_log_file creates HOST_DATA_DIR before preflight runs.

Adds early_data_dir_guard in preflight.sh, invoked from install-k8s.sh right after validate_config and beforesetup_log_file (with the same declare -F stale-bootstrap pattern as other gates). Network filesystem types are centralized in _pf_is_network_fstype, reused by the existing _pf_storage_type check (behavior unchanged there). The early guard skips when the data directory already exists so healthy re-runs still reach assess (#441), honors TRACEBLOC_ALLOW_NETWORK_FS, and uses remediation text that fits HOST_DATA_DIR under $HOME (no bogus /local/path advice).

Six new bats cases cover classification, pass/fail paths, and install ordering; manifest.sha256 is updated.

^{Reviewed by Cursor Bugbot for commit e4642d6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[LukasWodka]

bugbot run

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e4642d6. Configure here.}