fix(tests): Correct pipeline test failures (#239)

Fixes 4 test failures identified in pipeline run 239:

1. RunnerJobsService cancel tests:
   - Use updateMany mock instead of update (service uses optimistic locking)
   - Add version field to mock objects
   - Use mockResolvedValueOnce for sequential findUnique calls

2. ActivityService error handling tests:
   - Update tests to expect null return (fire-and-forget pattern)
   - Activity logging now returns null on DB errors per security fix

3. SecretScannerService unreadable file test:
   - Handle root user case where chmod 0o000 doesn't prevent reads
   - Test now adapts expectations based on runtime permissions

Quality gates: lint ✓ typecheck ✓ tests ✓
- @mosaic/orchestrator: 612 tests passing
- @mosaic/web: 650 tests passing

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/orchestrator/src/git/secret-scanner.service.spec.ts

@@ -434,11 +434,28 @@ SECRET=replace-me
       // Remove read permissions
       await fs.chmod(testFile, 0o000);
 
+      // Check if we can still read the file (e.g., running as root)
+      let canReadAsRoot = false;
+      try {
+        await fs.readFile(testFile);
+        canReadAsRoot = true;
+      } catch {
+        // Expected behavior for non-root users
+      }
+
       const result = await service.scanFile(testFile);
 
-      expect(result.scannedSuccessfully).toBe(false);
-      expect(result.scanError).toBeDefined();
-      expect(result.hasSecrets).toBe(false); // Not "clean", just unscanned
+      if (canReadAsRoot) {
+        // Running as root - file is readable despite chmod 0o000
+        // Scanner will successfully scan the file
+        expect(result.scannedSuccessfully).toBe(true);
+        expect(result.hasSecrets).toBe(true); // Contains AWS key
+      } else {
+        // Normal user - file is unreadable
+        expect(result.scannedSuccessfully).toBe(false);
+        expect(result.scanError).toBeDefined();
+        expect(result.hasSecrets).toBe(false); // Not "clean", just unscanned
+      }
 
       // Cleanup - restore permissions first
       await fs.chmod(testFile, 0o644);