test(config): stub active-unit discovery in the php-fpm catalog test

Objective: keep TestPHPFPMCatalogDisabledProbeValidates independent of the
host's running services. On the CI runner an active php8.3-fpm unit made the
template materialize php-fpm8.3, whose app the fake bindir does not carry.
Invariant: the shipped php-fpm profile with its fpm probe disabled still
validates on systemd and OpenRC; no systemctl or rc-status call leaves the
test.
Evidence: make check; go test -race -count=1 -shuffle=on ./internal/config;
the test also passes with a fake systemctl reporting php8.3-fpm active and
with /usr/bin/php* hidden through an overlay mount.
Limitations: None.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: inode64

internal/config/php_fpm_catalog_test.go

@@ -7,7 +7,9 @@ import "testing"
 // backends. The php-fpm8.4 instance comes from a fake binary under a stubbed
 // ${bindir}, so the result does not depend on which PHP the host has installed.
 // Validate covers the whole catalog, and its python services need the python3
-// app template materialized the same way.
+// app template materialized the same way. Active-unit discovery is stubbed
+// empty so a php-fpm unit running on the host cannot materialize a version
+// the fake bindir does not carry.
 func TestPHPFPMCatalogDisabledProbeValidates(t *testing.T) {
 	bindir := t.TempDir()
 	fakeBinary(t, bindir, "php-fpm8.4")
@@ -19,7 +21,9 @@ func TestPHPFPMCatalogDisabledProbeValidates(t *testing.T) {
 				"sermo.yml":        "engine: {backend: " + backend + "}\npaths: {services: [@ROOT@/services]}\ndefaults: {policy: {cooldown: 5m}}\n",
 				"services/php.yml": "name: php-fpm8.4\nuses: php-fpm8.4\nwatches:\n  fpm: {enabled: false}\n",
 			})
-			cfg, err := loadConfig(t, global, WithCatalogDirs(repoCatalogDir(repoRoot(t))))
+			cfg, err := loadConfig(t, global,
+				WithCatalogDirs(repoCatalogDir(repoRoot(t))),
+				withServiceUnits(backend, nil))
 			if err != nil {
 				t.Fatal(err)
 			}