disk-hygiene(test): isolate run_guard_powershell enabled flag from ambient argv in test_hygiene

[kyle-sexton]

Lane: merge-drive (review-deferral, rule 7 / rule 11b standalone stream)

Deferred from a codex P2 review thread on PR #971 (plugins/disk-hygiene/skills/clean/scripts/test_hygiene.py), so the deferral can cite a tracked issue.

Finding (codex P2)

"Isolate the enabled PowerShell helper from argv" — when a test wrapper supplies --disk-hygiene-enabled false in its own argv, run_guard_powershell still lets that ambient value override the value the test intends to exercise, so the test's mock does not fully seal the argv seam it aims to test.

Classification

P2, non-DEFER-FORBIDDEN: test-isolation quality in a test helper. Not data-loss, not a fail-open safety/merge gate, not security-posture, not silently-wrong output feeding an irreversible action. The production kill-switch enforcement it tests already landed (#968); this is about tightening the test's own isolation.

Deferral rationale

#971 (Closes #970) is a green, issue-linked, lane-authored test PR whose only blocker was this fresh codex thread. The finding is a test-isolation refinement, not a correctness/safety defect — deferred (not fix-repushed) to let #971 land and avoid the codex re-review treadmill; tracked here for independent follow-up.

Fix direction

In run_guard_powershell (or its test wrapper), isolate the enabled flag from ambient argv so a test wrapper's own --disk-hygiene-enabled cannot override the value under test (e.g. pass the flag explicitly / clear sys.argv in the helper's scope).

Category: test-coverage/test-isolation · priority: needs-triage.

[kyle-sexton]

This was generated by AI (triage-decide lane — intake routing).

Routed status: ready (simple; zero design decisions). NOT a duplicate of #970 — that one (closed via PR #971) sealed run_guard, run_guard_disabled, run_guard_powershell_disabled; this is a distinct follow-up from #971's own review covering the enabled variant run_guard_powershell, which #970 did not touch.

Verified on origin/main: #971 merged (10:18Z); run_guard_powershell (~line 1298) and the argv-isolation pattern helper run_guard_enabled_argv (~line 1089) are both present → no open prerequisite.

Fix (single file, plugins/disk-hygiene/skills/clean/scripts/test_hygiene.py): isolate run_guard_powershell's enabled flag from ambient argv so a test wrapper's own --disk-hygiene-enabled cannot override the value under test — mirror the argv-sealing run_guard_enabled_argv already applies (pass the flag explicitly / pin sys.argv in the helper's scope). Acceptance: a test whose own argv carries --disk-hygiene-enabled false still exercises the intended value; suite green under python -m unittest / pytest.

Category: test-coverage/test-isolation — latent fragility, not fail-open (the #968 kill-switch enforcement it tests already landed). priority: medium.

[kyle-sexton]