CI: hermetic spawns in apply/rollback tests (#823)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #823 (slice 3; the issue stays open for the remaining files).

What it does

Test-only. The apply/, rollback/, remove/ and get/ suites spawned socket-patch with a bare Command::new. Most swept SOCKET_* by hand, but apply_invariants and in_process_npm_multicopy did not, so a shell exporting SOCKET_DRY_RUN, SOCKET_JSON or SOCKET_ECOSYSTEMS failed 15 of their tests for reasons unrelated to the code under test.

• 13 files now spawn through common::hermetic_command. Their hand-rolled sweeps, hostile seeds and duplicate SOCKET_TELEMETRY_DISABLED / SOCKET_CLI_API_TOKEN lines are gone, because the builder already forces or removes those.
• New hermetic::Extra::Bundle replaces the gem suites' private BUNDLE_* sweep (4 files). It seeds BUNDLE_APP_CONFIG, which the gem crawler reads, and then scrubs it. cli_gem_variant_mismatch_policy had no BUNDLE_* scrub before and now gets one. spawn_env_hygiene gains a contract test for it.
• get/get_edge_cases_e2e.rs was already hermetic (it uses common::run_with_env). It was on the list only because a comment quoted the bare-spawn spelling the detector matches, so that comment is reworded.
• All 14 files leave PENDING_RAW_SPAWNS (140 → 126), so the ratchet keeps them hermetic.

Left out to avoid conflicts: apply/apply_network.rs and rollback/rollback_multicopy_blob_gate.rs, both changed by open PR #1402.

Evidence (red → green)

Hostile shell: SOCKET_DRY_RUN=true SOCKET_JSON=true SOCKET_ECOSYSTEMS=cargo SOCKET_OFFLINE=true BUNDLE_PATH=/nonexistent/bundle.

target	origin/main	this branch
apply (migrated files)	15 fail (6 apply_invariants, 9 in_process_npm_multicopy)	0 fail
rollback, remove, get	pass	pass

apply_network (9 more failures under that shell, on both main and this branch) is the excluded file above.

Normal environment: spawn_env_hygiene 14 passed, apply 132 passed (1 ignored), rollback 57 passed, remove 99 passed, get 86 passed. cargo fmt --all -- --check is clean. Running clippy on these test targets reports only findings that are already on main, in the unchanged common/mod.rs and prebuilt_common/mod.rs. CI's clippy job does not lint test targets.

CI on 49e78d7: all 86 checks either passed or were skipped (including ci-ok and clippy). Bugbot found no issues.

/code-review high

I fixed these findings in 49e78d7: the missing BUNDLE_* scrub in cli_gem_variant_mismatch_policy, a hostile seed the crawler didn't read, dead SOCKET_CLI_API_TOKEN / telemetry lines, and comments that ran past the wrap width. I left these out on purpose:

• Scrub BUNDLE_* in hermetic::command for every child. Suites that use run_with_env get no bundler scrub. For example, check_verifies_installed_tree::check_fails_on_an_unpatched_copy_in_a_refused_bundle_path fails under an ambient BUNDLE_APP_CONFIG, on main as well as here. Moving the sweep into the shared builder changes the environment of every CLI test child, so it's a follow-up for Spawn every CLI test child through one hermetic Command builder; 10 test files inherit ambient SOCKET_* today #823, not part of this slice.
• Use hermetic::binary_command() instead of hermetic_command(&binary()). I kept the spelling slice 2 (CI: hermetic spawns in scan/repair tests (#823) #1398) used. A tree-wide switch can be its own cleanup.
• Share one rollback_cmd between the two rollback invariant files. That's a helper refactor and out of scope here.

CI cost

No workflow change. A lean PR run is unchanged: same jobs, roughly the same job-minutes (about 28 Linux jobs, about 8 min wall time).

🤖 Generated with Claude Code

https://claude.ai/code/session_013sMuYxiSNRUULtv88CtBGM

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 49e78d7. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent)

• Head: 49e78d7
• CI: 36/36 non-skipped checks green (50 skipped by path filters); mergeable, no conflicts.
• Bugbot: reviewed 49e78d7, no findings; no open review threads.
• Already approved by Wenxin Jiang (@Wenxin-Jiang) on this head. Test-only change (Spawn every CLI test child through one hermetic Command builder; 10 test files inherit ambient SOCKET_* today #823 slice 3); apply_network.rs and rollback_multicopy_blob_gate.rs were deliberately left for a later slice.

---

Generated by Claude Code