feat(backend): add teardown() to the contract; backend teardown

Add an abstract teardown() classmethod to BottleBackend — the inverse of
setup(), surfaced as `./cli.py backend teardown [--backend=NAME]`
(uninstall). Symmetric with setup: it prints the privileged commands /
declarative config change to remove the host prerequisites.

- firecracker: NixOS-aware — disable the flake module (or drop the
  import) and rebuild, or `firecracker-netpool.sh down` imperatively.
- docker / macos-container: nothing to undo (no privileged host state);
  print a short note.

Not called by the launch path or the test suite. Extends test_cli_backend
for the new dispatch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

tests/unit/test_cli_backend.py

@@ -21,6 +21,7 @@ class TestCmdBackendDispatch(unittest.TestCase):
         b = MagicMock()
         b.setup.return_value = 0
         b.status.return_value = 3
+        b.teardown.return_value = 0
         return b
 
     def test_setup_dispatches_to_backend(self):
@@ -39,6 +40,14 @@ class TestCmdBackendDispatch(unittest.TestCase):
         b.status.assert_called_once_with()
         self.assertEqual(3, rc)
 
+    def test_teardown_dispatches_to_backend(self):
+        b = self._fake_backend()
+        with patch.object(cmd, "get_bottle_backend", return_value=b):
+            rc = cmd.cmd_backend(["teardown", "--backend", "firecracker"])
+        b.teardown.assert_called_once_with()
+        b.setup.assert_not_called()
+        self.assertEqual(0, rc)
+
     def test_no_backend_flag_uses_host_default(self):
         b = self._fake_backend()
         with patch.object(cmd, "get_bottle_backend", return_value=b) as gbb:
@@ -74,6 +83,9 @@ class TestDockerSetupStatus(unittest.TestCase):
              patch.object(docker_setup._util, "runsc_available", return_value=False):
             self.assertEqual(1, docker_setup.status())
 
+    def test_teardown_is_noop_success(self):
+        self.assertEqual(0, docker_setup.teardown())
+
 
 if __name__ == "__main__":
     unittest.main()