run e2e scenarios from a private copy

[atkrad]

Summary

• Each E2E scenario runs from its own temporary copy of the scenario directory, so a test does not write into the tracked files under scenarios/.
• The copy is made before the Kubernetes namespace is created. A symbolic link in the source is rejected, so a later open cannot leave the copy.
• The old copyTree helper is gone. The integration suite is unchanged.

Test plan

• Unit tests added/updated
• Scenario under scenarios/ (if behavior changes)
• nix run .#lint / pre-commit clean
• Manual smoke (command + expected result), if user-facing

Also ran go test ./internal/testing/... -race -count=1, go test ./... -race -count=1, and DEPLOYAH_E2E_FORCE=1 nix run .#test-e2e (46 tests). scenarios/ was unchanged after the Kind run.

Labels

• One of: kind/feature, kind/bug, kind/docs, kind/chore
• Add breaking-change if this breaks existing CLI or config behavior
• Add skip-changelog for internal-only PRs that should not appear in notes

Checklist

• Title is short and imperative (matches commit style)
• Docs / CLI help updated when user-facing (README.md, docs/cli/)
• No secrets or local-only paths in the diff

[codecov]

Codecov Report

❌ Patch coverage is 92.30769% with 2 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
internal/testing/workspace.go	92.30%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!