refactor(services): split command policy out of Repository into a services layer

[rdawebb]

refactor(services): split command policy out of Repository into a services layer, enforced by import-linter

Breaks up the Repository god object. Every command verb (install, uninstall, upgrade, cleanup, pin/unpin, link/unlink) moves out of core/repo.py into a new brewery.services package as a free function taking the repo as its first argument, leaving Repository as a read-only data facade over the catalog and the filesystem cache. Underneath it, the native pipeline stops taking a whole repo object and takes the three ports it actually uses, so providers no longer imports core.repo at all. The resulting one-way layering (cli > daemon > services > providers > core) is now checked by import-linter in just check, the pre-commit hooks, and CI rather than by convention. No behaviour changes.

What changed

New services layer

• services/{install,uninstall,upgrade,cleanup,pin,link,resolve,cask}.py — each former Repository method becomes a module-level function taking repo as its first argument: install_packages(repo, names, kind, ...), uninstall_packages, upgrade_packages, cleanup_packages, pin_packages/unpin_packages, link_packages/unlink_packages.
• env= is an overridable keyword on every service rather than always being resolved internally, and formula/cask become injectable parameters defaulting to brew.formula_backend/brew.cask_backend instead of being read off the repo.
• services/cask.py — install_casks/uninstall_casks/upgrade_casks, one named seam for the "hand to brew" path the three services share, typed against the narrow InstallBackend/UninstallBackend/UpgradeBackend protocols.
• services/resolve.py — installed_formulae(), the alias-resolving lookup that pin and link both need.
• services/link.py — the old providers/link_service.py (run_link/run_unlink) plus the link_packages/unlink_packages policy wrappers that used to live in the repo.
• services/cleanup.py — cleanup_packages() with its previously-nested remove_rack()/sweep_rack() helpers hoisted to module level, and _CLEANUP_CONCURRENCY moved with them.
• services/upgrade.py — target selection splits into _select_targets(), so the entry point reads select → dispatch → re-scan rather than one long branch; the result tuple gets the UpgradeOutcome alias.
• core/models.py — Notes = list[tuple[str, str]] promoted out of link_service and shared by every service for advisories and failures.

Repository reduced to a data facade

• core/repo.py keeps only close, get_all_installed, get_details, search, and get_outdated.
• cli/commands/{install,uninstall,upgrade,cleanup,link,pin}.py and daemon/catalog_refresh._maybe_cleanup() call the services directly instead of the repo methods.

Pipeline decoupled from Repository

• providers/install_service.py and providers/upgrade_service.py merge into providers/pipeline.py (carrying PIPELINE_TIMEOUT). build_orchestrator(), run_install(), and run_upgrade() take catalog/cache_mgr/formula as explicit keyword ports instead of a whole repo.
• install_adapters.py — RepositoryCatalogAdapter becomes CatalogAdapter, taking the catalog and cache manager directly. New CatalogSource, InstalledSource, and FallbackBackend protocols name only the four catalog reads, the one installed-state read, and the two verbs the adapter forwards, keeping the boundary checkable without dragging the full Catalog surface across it.
• providers/base.py — PackageBackend splits into InstallBackend/UninstallBackend/UpgradeBackend, with PackageBackend composing all three, so each service can ask for exactly the verbs it uses.
• providers/brew.py — _make_backend()'s SimpleNamespace closure becomes a real BrewBackend class with a static assertion against PackageBackend.
• providers/orchestrator.py — FormulaRowP re-declared as read-only properties: a protocol's mutable attributes are invariant and need a writable target, which the frozen FormulaRow is not. bottle_url/bottle_sha256 are now correctly typed as optional, with the narrowed sha bound to a local before use.
• providers/cellar.py — remove_rack() (formerly uninstall_service._remove_formula()) joins the rest of the keg-removal primitives, and uses cellar's own rmtree() wrapper rather than shutil.rmtree directly. run_uninstall() moves up into services/uninstall.py alongside its caller, leaving providers with the primitives and none of the policy.
• providers/pin_service.py renamed to providers/pinning.py.

Moves within core

• core/deps.py (new) — blocking_dependents(), formerly Repository._blocking_dependents(), now a pure function over an already-merged package list with no repo access. The caller decides where the list comes from and reuses the kind=None scan when there was one, so a cask-only batch never scans the cellar at all.
• analysis/status.derive_local_status() moves into core/merge.py, its only caller; the now-empty analysis package is removed.

Layering contracts

• pyproject.toml — import-linter added as a dev dependency with two contracts: an exhaustive layers contract pinning cli > daemon > services > providers > core, and a forbidden contract keeping providers off core.repo.
• lint-imports wired into a new just layers recipe, just check, the pre-commit hooks, and the CI check job.

Behaviour notes

• No user-visible change: every command runs the same code, reached through a function rather than a method.
• Repository(formula_backend=..., cask_backend=...) is gone — inject backends per call via each service's formula=/cask= keywords instead.
• repo.install_packages(...) and its siblings no longer exist; call brewery.services.<verb>.<verb>_packages(repo, ...).
• Adding an import that points up a layer now fails just check, the pre-commit run, and CI. exhaustive = true means a new top-level package under brewery must be added to the contract before it can be imported at all.
• providers importing core.repo is a hard error, so anything in providers needing repo state must take the narrow port instead.

Tests

• tests/unit/test_repo.py (new) — asserts Repository's public surface is still the frozen read-only set, so a mutating verb landing back on the facade is a caught regression.
• tests/integration/test_repo.py → test_querying.py, keeping only the facade's read queries (get_all_installed, outdated derivation, get_details, search). The ~930 lines of command tests move out to test_installing.py, test_uninstalling.py, test_upgrading.py, test_cleanup_service.py, and test_pin_link_services.py, with shared fixtures and helpers extracted into _repo_helpers.py. The rename also keeps the basename unique against the new unit-level test_repo.py, which pytest's rootdir-relative module naming requires.
• tests/unit/test_install_service.py and test_upgrade_service.py merge into test_pipeline.py, driving the explicit catalog/cache_mgr/formula ports; _stubs.MockRepo is replaced by a RecordingBackend.
• test_install_adapters.py rebuilt against CatalogAdapter's two constructor arguments rather than a whole repo; the _remove_formula() cases move to test_cellar.py alongside remove_rack().
• test_link_service.py → test_link.py, test_pin_service.py → test_pinning.py, and test_status.py/test_uninstall_service.py re-pointed at their new import paths.