feat(#122 part 1): uninstaller --purge leaves no trace

[aradanmn]

Part 1 of #122. Part 2 (routing $HOME artifacts to .workdir/) is #182 —
independent, no file overlap, either can merge first.

Problem

A full uninstall removed the launcher tree and stopped. Three things always
survived: the BYOK CurseForge key (it lives outside the install root), the
evsieve build container plus its podman storage, and the Steam shortcut — which
the script merely told you to remove yourself.

--purge

Covers all three. Mutually exclusive with --keep-data, checked after the
whole argv is parsed so flag order cannot decide it, and honours --dry-run
throughout. Without --purge nothing changes — a plain full uninstall still
spares the API key on purpose, so a reinstall need not re-prompt.

remove-from-steam.py — the inverse of add-to-steam.py

shortcuts.vdf holds every non-Steam shortcut the user has: emulators,
other launchers, work tools. A byte-splice that guesses wrong doesn't fail
loudly, it silently destroys all of them. So this is a real typed VDF parser,
not a regex, with four guards:

1. Round-trip check — re-serializing the unmodified parse must reproduce
   the input byte for byte, or we don't understand the file and refuse to write.
2. Backup — timestamped copy before any rewrite.
3. Narrow matching — only the launcher path, our exact app name, or an exe
   under TARGET_DIR. A user's own Minecraft shortcut survives.
4. Steam must not be running — it keeps shortcuts.vdf in memory and
   rewrites it on exit, so an edit made now is silently reverted. We refuse
   (exit 2) rather than report a success that will evaporate. We never restart
   Steam for the user: steam -shutdown over SSH has wedged Game Mode before.

Remaining entries are renumbered contiguously; the SteamGridDB artwork
add-to-steam.py downloaded is removed by appid.

Container removal — a deliberate narrowing of the issue

The issue floated podman system reset. That wipes every container, image
and volume the user owns. On a Deck those are probably only ours, but
"probably" is not a basis for deleting someone else's containers.

So: remove the named mcss-evsieve-build box and its debian:12 image, and
nothing else (PRINCIPLES #7). The shared ~/.local/share/containers store is
reclaimed only when podman reports zero containers and zero images left —
via podman unshare rm, for the mapped-root UIDs a plain rm can't touch.
Otherwise we say we kept it and why.

Say the word if you'd rather have the nuclear option behind an extra flag.

Tests

tests/test_uninstall_purge.sh — 19 tests, in the CI baseline. Weighted toward
what must survive, since that's the unrecoverable direction: foreign
shortcuts and their artwork, worlds under --keep-data, the API key without
--purge, and the whole tree on a rejected or dry-run invocation.

Mutation-tested — nine mutations. Seven caught first pass; two survived
and exposed real gaps, now closed:

Surviving mutation	Gap	Fix
dry-run ignored for artwork	dry-run was only asserted against the vdf, so a dry run deleting the user's library art would have passed	T4.8
round-trip guard removed	nothing exercised the guard's refusal, only the property it checks	T4.9

Verification

End to end against a sandboxed fake $HOME + Steam tree: our entry and artwork
removed, two foreign shortcuts renumbered 0/1 with artwork intact, backup
written, second run a clean no-op, unparseable file refused and left byte-identical,
and the Steam-running guard exercised against a real process named steam
(killed by tracked PID, never by name).

shellcheck clean, no new warnings. --keep-data regression-tested.

Not done

Not hardware-validated. Needs the destructive ~20 min Deck sitting from the
v1.2.4 plan — the only way to exercise real podman/distrobox removal and a real
Steam library. Worth pairing with the --dry-run output first.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Dru6wVc2ZcjiTpa6p7yJDh

[aradanmn]

Heads-up on merge order: #182 and this PR both add a line to the BASELINE map in .github/workflows/ci.yml at the same anchor, so whichever merges second will conflict there — one line, nothing else. Verified by a trial merge; ci.yml is the only conflicting file.

Merge either first and ping me; I'll rebase the other.