fix(tests): stop the suite reading ambient environment config

[ProtocolWarden]

Stacked on #73. Base is fix/rc1-budget-headroom, because this PR's own log entry needs the headroom #73 creates — at the current 400-line budget, writing it would red-fail the audit. GitHub will retarget this to main automatically once #73 merges.

REPOGRAPH_BOUNDARY_ARTIFACT_FILE leaked from the caller's shell into every test. Two that assert the "no artifact configured" path were directly contradicted by it:

test_reconcile.py::TestAC1SingleSourceOfTruth::test_no_artifact_no_scrub_targets
test_boundary_detectors.py::TestB2Required::test_b2_flags_missing_required_boundary_source

The exposure was two modules, not the one reported. Worth having checked for: the second lives in a file that already knows about the variable — it calls monkeypatch.setenv at line 71 — and still had a test that inherited it.

Why it matters

Backwards in the way that matters. The variable is legitimately exported by anyone who runs the audit locally or pushes through .hooks/pre-push, and is absent in CI. So a developer with a working setup saw a red suite while CI stayed green — the failure mode that teaches people to ignore their own test results.

The fix

An autouse fixture in tests/conftest.py clearing the variable for every test, rather than a delenv at the two call sites. The defect is that the suite reads ambient config at all; patching the two known victims leaves the next artifact-sensitive test to rediscover it.

Tests that want the variable still set it explicitly with monkeypatch.setenv — unaffected, and covered by a test.

tests/test_env_isolation.py pins the fixture. Without it a later refactor could drop the fixture and the only symptom would be a suite that passes in CI and fails on the machines of the people most likely to run it. It asserts the isolation list against boundary._ARTIFACT_FILE_ENV rather than a string literal, so renaming the variable in the detector fails the test instead of silently emptying the isolation.

(First draft asserted only on os.environ and tripped our own T8 — "test file imports nothing from any src package". Fair catch by our own detector: it was testing Python, not Custodian. Rewritten to assert against the constant the detector actually reads.)

Verification

	result
suite, variable unset	1242 passed, 5 skipped
suite, variable set	1242 passed, 5 skipped
the two originally-failing tests, variable set	2 passed
audit	clean apart from pre-existing W2 (core.hooksPath unset locally; CI sets it as the audit job's first step)

Baseline before this PR was 1238 passed / 5 skipped; the four added tests account for the difference.

Pre-existing at origin/main — not caused by #72, which observed it and deliberately left it alone to stay focused.

🤖 Generated with Claude Code