fix(tests): conftest sys.modules baseline + tests-side lint (closes #762)

[AndriiPasternak31]

Summary

Cross-file sys.modules pollution caused all 50 tests in
tests/test_audit_log_unit.py to fail at fixture setup when run as part
of the full integration suite (pytest tests/). Standalone they pass
53/53. This PR retires the whole bug class instead of patching the
target file alone — it would have been the 4th occurrence of the same
shape (#752, #714, #763).

Root cause (AC3 — polluter identified)

tests/test_validation.py:35 and tests/test_watchdog_unit.py:54
assign sys.modules["utils.helpers"] = _stub at module-collection
time. The stub is missing iso_cutoff. When
test_audit_log_unit.py's audit_ops fixture runs
del sys.modules["db.audit"] followed by from db.audit import ...,
the import chain hits
db/__init__.py → db/schedules.py → from utils.helpers import iso_cutoff
and raises ImportError: cannot import name 'iso_cutoff' from 'utils.helpers'.

Reproducer (deterministic, no pytest-randomly needed because pollution
fires at collection):

uv run pytest tests/test_audit_log_unit.py tests/test_validation.py -q
# → 53 errors on tests/test_audit_log_unit.py

What changed

• tests/conftest.py — capture a snapshot of canonical backend
  modules (utils.helpers, models, db.* subtree, services.*,
  adapters.*, dependencies, utils.credential_sanitizer)
  immediately after the existing _preload_backend_models() runs,
  before any test file is collected. An autouse function-scoped fixture
  restores the snapshot both before and after every test. The
  restore is conservative — only keys whose baseline was a real module
  object get restored; keys that didn't exist at preload are left alone
  so test files can install their own session-scoped stubs without
  regression.

  Captured at conftest import time, not at fixture setup, per Codex
  finding 3 in the plan: a fixture-setup snapshot would record an
  already-polluted value and treat it as truth.

• tests/test_audit_log_unit.py — convert the 3 bare sys.modules
  ops (lines 34–40, 130–131, 347–348) to monkeypatch.delitem; remove
  the now-redundant module-level utils.helpers stub.

• tests/lint_sys_modules.py — AST-based lint flagging
  sys.modules[k]=v, del sys.modules[k],
  sys.modules.setdefault/pop/update(...) outside the allowlist
  (conftest.py files; monkeypatch.* calls; the
  _STUBBED_MODULE_NAMES+_restore_sys_modules self-contained
  snapshot pattern precedented by
  tests/unit/test_telegram_webhook_backfill.py).

  Baseline-ratcheted: the survey of tests/**/*.py turned up 223
  pre-existing violations across 65 files. Fixing all of them is out of
  scope for fix(tests): test_audit_log_unit.py — 50 collection ImportErrors when run in full suite #762. The lint reads tests/lint_sys_modules_baseline.txt
  and fails CI only when a file exceeds its baseline count. Regenerate
  with python tests/lint_sys_modules.py --regenerate-baseline.

• tests/lint_sys_modules_baseline.txt — committed baseline of
  per-file violation counts.

• tests/test_lint_sys_modules.py — 25 unit tests covering each
  banned pattern (positive), each exempted form (negative — monkeypatch,
  conftest allowlist, helper-marker pair) per Claude subagent's H3,
  plus baseline-diff semantics and a repo-state invariant that the
  committed baseline matches the current scan.

• .github/workflows/backend-unit-test.yml — new
  lint-sys-modules job runs python tests/lint_sys_modules.py
  (stdlib-only, ~2 min, single Ubuntu runner).

Importlib spike — RED

The plan's Step 2 spiked --import-mode=importlib first. It came back
RED: the bug class is deliberate sys.modules[k] = stub assignment in
test code, which importlib mode does not address (Codex's caveat in the
plan was correct). Symptoms persisted unchanged across both modes.
That's why this PR ships the red path (conftest baseline + lint)
rather than the green path (importlib + lint).

Verification

Check	Before	After
pytest tests/test_audit_log_unit.py (isolation)	53 passed	53 passed
pytest tests/test_audit_log_unit.py tests/test_validation.py (polluter pair)	53 errors on target	0 errors on target
pytest tests/test_*_unit.py failing-ID set	105 IDs	52 IDs (Δ = −53, net new = 0)
target file × 3 consecutive runs under 5-file polluter mix	inconsistent errors	0 errors on target across all 3
tests/test_lint_sys_modules.py	n/a	25 passed
python tests/lint_sys_modules.py	n/a	exit 0 (223 baseline-allowed)

pytest-randomly is not installed locally (the project keeps it
in-workflow only). The CI plugin set will re-run this verification
under 3 seeds when the workflow fires.

Acceptance criteria

• ✅ AC1 — pytest tests/ reports 0 ERROR/FAILED lines for
  tests/test_audit_log_unit.py (verified via deterministic
  collection-order reproducer; pytest-randomly will exercise random
  order in CI).
• ✅ AC2 — All 53 tests pass standalone and under the known polluter
  mix across 3 consecutive runs.
• ✅ AC3 — Polluter identified by deterministic import-chain analysis:
  tests/test_validation.py:35 overwrites sys.modules["utils.helpers"]
  with a stub missing iso_cutoff at module-collection time. Under
  the conftest-baseline fix this remains observability of the historical
  polluter, not an active bug — the autouse restore neutralizes it,
  and the lint rule prevents new occurrences in future tests.

Test plan

• CI: backend-unit-test workflow runs the new lint-sys-modules
  job and the existing pytest matrix.
• CI: no new failing test IDs vs base branch (existing diff job).
• Local: python tests/lint_sys_modules.py exits 0.
• Local: pytest tests/test_lint_sys_modules.py 25/25.
• Local: pytest tests/test_audit_log_unit.py tests/test_validation.py — 0 errors on target.

Refs: #762

[vybe]

LGTM — clean test-infrastructure fix. Root cause well-identified, approach retires the bug class rather than patching the 4th occurrence. Baseline-ratcheted lint + CI job is the right call.