test_hygiene.py: nine of ten TestCase classes never run in CI

[kyle-sexton]

Finding

plugins/disk-hygiene/skills/clean/scripts/test_hygiene.py defines ten
TestCase classes. CI executes exactly one of them.

The only invocation in .github/workflows/ci.yml (job
disk-hygiene-guard-windows):

      - name: Run disk-hygiene GuardTests on Windows
        working-directory: plugins/disk-hygiene/skills/clean/scripts
        run: python -m unittest -v test_hygiene.GuardTests

The classes and their line numbers:

Line	Class	Runs in CI
91	HygieneTests	no
2342	VersionFloorTests	no
2379	StandingPolicyTests	no
2505	OsAutocleanAdvisoryTests	no
2540	LeastObservableEnginePathTests	no
2817	TargetRootIdentityTests	no
2949	HandoffVerifyTests	no
3827	GuardTests	yes
7132	DirectReadKillSwitchTests	no

HandoffVerifyTests (line 2949) is where create_checkout lives — the
function whose git -C <fixture> config user.email test@example.com produced
the #2827 -> #2830 config-poisoning incident. Its coverage has never executed
in CI.

The other reachable path, scripts/run-plugin-tests.sh, discovers
plugins/**/*.test.sh and so runs the co-located wrapper
plugins/disk-hygiene/skills/clean/scripts/hygiene.test.sh, which does invoke
the whole module — but that lane SKIPs (exit 0) when Python is absent or below
the parsed MIN_PYTHON floor, so it is not a guarantee either. Worth
confirming as part of the fix which of the two lanes is intended to be
authoritative.

This is the same family as #2856 / #2862: coverage that exists in the tree,
reads as tested, and does not gate.

Measurement — flipping CI to the whole module would land RED

Measured locally, not asserted. Running the whole module:

$ python -m unittest test_hygiene
FAIL: test_preview_allows_root_children_os_managed_snapshot (test_hygiene.HygieneTests.test_preview_allows_root_children_os_managed_snapshot)
FAIL: test_stash_must_exist_in_an_independent_checkout (test_hygiene.HandoffVerifyTests.test_stash_must_exist_in_an_independent_checkout)
Ran 303 tests in 8.773s
FAILED (failures=2, skipped=6)

Both failures reproduce identically against the unmodified origin/main copy
of the file, so they are pre-existing and not an artifact of any in-flight
change:

$ # origin/main version of test_hygiene.py, same command
FAIL: test_preview_allows_root_children_os_managed_snapshot (test_hygiene.HygieneTests.test_preview_allows_root_children_os_managed_snapshot)
FAIL: test_stash_must_exist_in_an_independent_checkout (test_hygiene.HandoffVerifyTests.test_stash_must_exist_in_an_independent_checkout)
Ran 303 tests in 10.559s
FAILED (failures=2, skipped=6)

The CI-executed class is green on its own: python -m unittest test_hygiene.GuardTests -> Ran 127 tests ... OK (skipped=3).

Consequence for the fix

A one-line flip of the CI invocation to the whole module is therefore NOT
available — it lands a red required lane, and this repo's own doctrine is that
a gate landing red is a gate on its way to being disabled.

Proposed staged path instead:

1. Land the CI invocation over the whole module together with a skip/expected-
   failure baseline in the shape this repo already uses
   (scripts/orphaned-fixtures-baseline.txt,
   scripts/changelog-parity-baseline.txt): exact entries, stale-entry guard
   so a line cannot outlive its debt.
2. File one burn-down item per baselined failure and drain them.
3. Delete the baseline when empty.

Alternatively, fix the two failures first and flip in one step — cheaper if
they are shallow. Deciding that requires diagnosing them, which this issue does
not do.

Related

• test-fixture isolation: git -C does not survive an exported GIT_DIR #2840 — fixture git isolation; the lane that measured this while holding the
  file. Its fix is a module-level os.environ.pop, which runs at import and so
  takes effect under the GuardTests-only invocation as well.
• docs(source-control): correct stale-base gate coverage and drop the strict recommendation #2827 / docs(source-control): correct stale-base gate coverage and drop the strict recommendation #2830 — the abandoned-and-rebuilt PR pair the untested
  create_checkout path produced.
• ci: managed-scope-sync and state-key-sync run but are not in the ci-status required aggregate #2856 / ci: gate every ci.yml lane through the ci-status aggregate #2862 — same family: lanes that ran without gating.

[kyle-sexton]