Remove infrastructure _CommandRunner from public BumpOptions and abstract VCS/filesystem behind a repository port

[coderabbitai]

Background

Raised during review of PR #75 (refresh stale Cargo lockfiles before publish preflight).

Problem

BumpOptions is a public domain dataclass but now exposes runner: _CommandRunner | None = None, an infrastructure protocol. This leaks execution infrastructure into the domain boundary. Lockfile discovery also mixes git VCS calls and filesystem operations in a single function without an abstraction layer.

Resolution

• Remove runner from BumpOptions; pass it at the call site or via a dedicated infrastructure port.
• Introduce a repository/VCS port (e.g. a LockfileRepository protocol) to separate git-tracked file discovery and cargo lockfile operations from domain logic in bump.py and lockfile.py.
• Update callers and tests accordingly.

References

• PR: Refresh stale Cargo lockfiles before publish preflight (#61) #75
• Related: Move cmd-mox integration out of production modules behind a CommandRunner port #62
• Requested by: @leynos

[coderabbitai]

🔗 Related PRs

leynos/repovec-appliance#37 - Serialize qdrant key provisioning (#29) [merged]
leynos/dear-diary#42 - Adopt shared-actions stage-release-artefacts for cargo-binstall [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!