bootstrap's new --fix hint overpromises on Linux, the one host where it never installs anything

[alpCaner]

Found while reviewing my own fix for #355

feat/v06-batch at 13891f1. Introduced by 624d2c2.

#355 added a second line to bootstrap's missing-prerequisites refusal:

Missing required tools: cmake ninja xz wget.  Install them and re-run.
Or run `tan doctor --build --fix` to install them from the SDK's manifest.

On Linux that second sentence is false. alp-sdk dev's metadata/bootstrap.json declares prerequisites.install.linux as:

{"git": "sudo apt-get install -y git", "cmake": "sudo apt-get install -y cmake",
 "python3": "sudo apt-get install -y python3", "ninja": "sudo apt-get install -y ninja-build",
 "xz": "sudo apt-get install -y xz-utils", "wget": "sudo apt-get install -y wget"}

Every one of them starts with sudo, and doctor --build --fix deliberately refuses and prints any command whose first word is sudo (doctor_cmd.py, fix_needs_sudo_check, doctor.fix-needs-sudo) — because under --format json this process's stdio is captured end to end, so a password prompt would hang forever rather than fail loudly. That refusal is correct and is not the defect.

The defect is that the sentence pointing at it says "to install them". On Linux the command installs nothing; it prints six sudo apt-get install -y … lines for the customer to run. The wording is accurate only on Windows (winget, user-scope) and macOS (brew), neither of which needs elevation.

Linux is the host the container e2e represents and the most common customer host for this SDK, so the one platform where the new hint is wrong is the one where it is read most.

Impact

Small, but it is the same class the fix was closing: #355 existed because a clean host was told a fact and not the remedy. Replacing it with a remedy that does not do what it says on that host trades one wrong expectation for another. A customer runs tan doctor --build --fix, sees six warnings and nothing installed, and reasonably concludes the tool is broken.

Acceptance criteria

• The hint is true on every platform. Either say what --fix actually does on each ("runs them where it can, prints the exact command where elevation is needed, because tan never spawns sudo"), or select the wording from the host it is printing on.
• No claim that anything is installed where the manifest's commands need elevation.
• A test asserts the POSIX wording against a manifest whose install commands begin with sudo, and the Windows/macOS wording against ones that do not — the current test pins only the oracle's first line.
• The oracle's first line stays byte-identical, two spaces before Install included.

Related: #355, #91, alp-sdk#959.

[alpCaner]

Fixed on dev in ac79d4c (PR #352). dev IS this repo's default branch, so Closes does fire here -- but this issue was filed AFTER the PR body's closing-keyword list was written, so it was never in it. Closed by hand; a merged PR body cannot close retroactively.

Verified on the merged-dev freeze in a pristine ubuntu:24.04 carrying only ca-certificates, git, python3.

Observed verbatim on Linux: Or run \: it prints the exact command for each tool from the SDK's manifest, and runs the ones needing no elevation (tan never spawns \ itself). Keyed on the manifest's COMMANDS, not the platform -- alp-sdk's prerequisites.install.linux is six sudo apt-get install -y ... entries, while macOS brew and Windows winget need no elevation and keep the plain wording.

[alpCaner]

Correction to the previous comment

The comment above was posted through a shell that ate the quoted strings, so the two most important literals came out empty. The observed Linux text, verbatim:

Missing required tools: cmake ninja xz wget.  Install them and re-run.
Or run `tan doctor --build --fix`: it prints the exact command for each tool from the SDK's manifest, and runs the ones needing no elevation (tan never spawns `sudo` itself).

First line byte-identical to bootstrap.sh's, two spaces before Install included. Second line is the #370 wording — it does not promise an install on a host where the manifest's commands all need elevation.

Measured on the merged-dev freeze in a pristine ubuntu:24.04, where prerequisites.install.linux is six sudo apt-get install -y ... entries and doctor --fix refuses to spawn sudo.

Follow-up filed as #375: in TEXT mode, doctor --build --fix still says nothing when the consent gate suppresses it entirely (no TTY), so a customer cannot tell "nothing to fix" from "tan declined to fix". The JSON envelope does carry doctor.fix-suppressed.