test(policy): e2e integration tests for require_pinned_constraint (follow-up to #1494)

[danielmeppiel]

Summary

Follow-up to #1494 that closes the user-promise gaps in test coverage
left by the original PR. #1494 shipped 65 unit tests plus a partial
e2e file (tests/integration/test_policy_pinned_constraint_e2e.py
covering only the block-aborts and warn-emits paths). This PR adds the
remaining CliRunner-based end-to-end coverage for every user-observable
promise the policy field makes.

No production code changes.

Promises covered

Promise	Test	Tier
B -- pinned dep proceeds past the gate (caret, bare exact)	TestPromiseBPinnedDepPassesPolicyGate (x2)	e2e
C -- policy_gate forwards direct_dep_keys (transitive bleed-through guard from #1494 Copilot follow-up)	TestPromiseCDirectDepKeysWiring	e2e (wiring)
D + G -- block exits 1 and diagnostic cites dep + pinning hint + check name inside violation block	TestPromiseDGBlockDiagnosticAndExitCode	e2e
E -- backward compat: require_pinned_constraint: false (default) does not block	TestPromiseERequirePinnedFalseDoesNotBlock	e2e
F -- --dry-run previews "Would be blocked" without raising or mutating disk	TestPromiseFDryRunPreviewsViolation	e2e

6 tests added across 5 test classes. New directory tests/integration/policy/
(mirrors the existing tests/integration/marketplace/ convention). Two
fixtures under tests/fixtures/policy/require_pinned/ (block + off variants).

Mutation-break evidence

Each test was certified by removing the production guard, confirming
the test fails, and restoring. Per the test-coverage-expert north star:
"If this code silently drifts six months from now, will any test
fail loudly enough that a maintainer will see it before a user does?"

Test	Production guard mutated	Result with mutation
Promise B	_check_pinned_constraints: if reason is None: continue -> force violation	2 failed (both Promise B tests)
Promise C	direct_dep_keys=... dropped from all 3 forwarding sites (policy_gate, policy_target_check, install_preflight)	1 failed
Promise D+G	violations.append(f"{key}: {hint}") -> "MUTATION-NO-REF"	1 failed
Promise E	if not policy.require_pinned_constraint: return ... early-exit removed	1 failed
Promise F	if enforcement == "block" and not dry_run: -> if enforcement == "block":	1 failed

All mutations restored; final test run is green.

Lint evidence

$ uv run --extra dev ruff check src/ tests/
All checks passed!

$ uv run --extra dev ruff format --check src/ tests/
1107 files already formatted

$ uv run --extra dev python -m pylint --disable=all --enable=R0801 \
    --min-similarity-lines=10 --fail-on=R0801 src/apm_cli/
Your code has been rated at 10.00/10

$ bash scripts/lint-auth-signals.sh
[+] auth-signal lint clean

Test evidence

$ uv run --extra dev pytest tests/integration/policy tests/unit/policy \
    tests/integration/test_policy_pinned_constraint_e2e.py -q
813 passed, 1 xfailed, 17 subtests passed in 2.81s

The 1 xfailed is the pre-existing #1488 sentinel, unrelated to this PR.

Observation worth filing separately

While writing Promise B, I noticed that the =1.2.3 alternate
exact-version syntax is classified by _constraint_pinning.py as
BARE_BRANCH (rendered as "bare branch '=1.2.3' tracks a moving
tip"), even though the #1494 commit message lists exact versions among
the pinned forms. Only the bare 1.2.3 form is recognized as pinned.

This is a real UX gap but is out of scope for a test-only PR. The new
e2e uses the bare form and adds an in-file comment pointing at the
gap. A follow-up issue would be appropriate.

How to test

git fetch origin test/policy-require-pinned-e2e
git checkout test/policy-require-pinned-e2e
uv run --extra dev pytest tests/integration/policy -v

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.