test(#1338): amend runtime_tools pins that encoded the D29 defect semantics

Two assertions in packages/mosaic/src/mutator-gate/runtime_tools_unittest.py
pinned the behaviour D29 identifies as the defect: an envless revoke-lease.py
returning rc=2. They are changed here under the test-is-the-defect exemption,
stated on the record rather than made quietly. One new assertion is added to
cover what the relaxation must NOT reach.

Why the reclassification is justified. Not because the old pin was careless: it
was deliberate entrypoint doctrine, born in e4d7d45 (WI-3, #842) alongside the
tool itself, and its twin pins the identical property for mutator-gate. Two
measurements beat the doctrine.

  1. Unsatisfiable precondition. The doctrine's only reachable firing point
     cannot be reached by the live fleet. Seats launch with zero MOSAIC_LEASE_*
     (measured, pane pid 8596; 19 of 19 live panes, see #1340), the framework
     ships no provisioning path for fleet launches, and the deployed extension
     does not enforce the total gate, since live seats use tools daily.

  2. Gate-enforced redundancy. For the one case the doctrine protects, a leased
     session whose identity env is stripped: the strip must occur in the
     extension host's own env to reach the observer, at which point the gate
     also loses identity and denies GATE_UNAVAILABLE rc=2 on every tool call
     (measured). The stripped session may compact but cannot mutate. Pre-fix it
     merely died at compaction instead. No mutation path opens either way.

The no-ungated-mutation property lives in the gate, not the revoker. That is
why the revoker moves and the gate does not.

Changes:

1. test_revoker_entrypoint_denies_when_identity_environment_is_absent becomes
   test_revoker_entrypoint_noops_when_identity_environment_is_absent and asserts
   rc=0. The stem is kept so history greps still find it.

2. NEW: test_revoker_entrypoint_denies_when_identity_environment_is_half_provisioned
   asserts rc=2 for socket-only and session-only environments. The no-op is
   reachable only on TOTAL absence; half-provisioned is a machinery-present
   failure and must still fail closed. main() already pinned this, but the
   entrypoint did not, and the entrypoint is what the runtime extension spawns.

3. In test_revoker_fails_closed_on_identity_reply_and_transport_errors, ONLY the
   ({}, ...) element leaves the cases list. The five machinery-present cases
   (malformed session id, ok:false, state:VERIFIED, OSError, JSONDecodeError)
   stay fail-closed and are untouched.

4. test_gate_entrypoint_denies_when_identity_environment_is_absent is left
   UNCHANGED, with a comment recording why. Relaxing it the same way would be a
   real downgrade. The revoker/gate asymmetry is intentional and must not be
   "fixed" later.

Controls run, all three directions, none assumed:

  - Fix plus amendments: 26/26 OK, rc=0.
  - revoke-lease.py alone reverted to origin/next, amendments kept:
    FAILED (failures=1), rc=1. The amended entrypoint assertion still bites.
  - Guard weakened to `len(present) < 2` so half-provisioned falls through to
    the no-op: FAILED (failures=1), rc=1. The new assertion bites.

Required by two independent re-verdicts, both REQUEST_CHANGES on head 9fed3838,
both of which superseded their own earlier APPROVE after CI surfaced the pinned
contract: rev-security-01 review id 242, rev-security-02 review id 243. Each was
asked to refute the reclassification before accepting it and each attempted it
in writing. Item 2 above is rev-security-02's requirement and was not in the
first re-verdict. Both re-affirm the guard's own semantics as correct; what was
missing was the second half of a deliberate contract change.

Refs #1338, #1340

packages/mosaic/src/mutator-gate/runtime_tools_unittest.py

@@ -337,7 +337,13 @@ class ExecutableEntrypointTest(unittest.TestCase):
             runpy.run_path(str(TOOLS_DIR / "launch-runtime.py"), run_name="__main__")
         self.assertEqual(raised.exception.code, 64)
 
-    def test_revoker_entrypoint_denies_when_identity_environment_is_absent(self) -> None:
+    def test_revoker_entrypoint_noops_when_identity_environment_is_absent(self) -> None:
+        # D29 supersession. This assertion previously pinned rc=2. Absent identity
+        # means no lease was ever held, so there is nothing to revoke and the correct
+        # result is no-op success. The old pin was written in e4d7d45 (WI-3), the same
+        # commit that shipped launch-runtime.py's lease-var provisioning, on the
+        # assumption that an envless revoker was unreachable. D29 falsified that in
+        # production. Behavioural pins live in src/lease-broker/revoke_noop_unittest.py.
         with patch.object(
             sys,
             "argv",
@@ -352,9 +358,42 @@ class ExecutableEntrypointTest(unittest.TestCase):
             io.StringIO()
         ), self.assertRaises(SystemExit) as raised:
             runpy.run_path(str(TOOLS_DIR / "revoke-lease.py"), run_name="__main__")
-        self.assertEqual(raised.exception.code, 2)
+        self.assertEqual(raised.exception.code, 0)
+
+    def test_revoker_entrypoint_denies_when_identity_environment_is_half_provisioned(
+        self,
+    ) -> None:
+        # The no-op above is reachable ONLY when identity is TOTALLY absent. A
+        # half-provisioned environment is a machinery-present failure and must still
+        # fail closed. main() already pins this; the entrypoint did not, and the
+        # entrypoint is what the runtime extension actually spawns.
+        half_provisioned = (
+            {"MOSAIC_LEASE_BROKER_SOCKET": "/run/test/broker.sock"},
+            {"MOSAIC_LEASE_SESSION_ID": "d" * 64},
+        )
+        for environment in half_provisioned:
+            with self.subTest(environment=environment), patch.object(
+                sys,
+                "argv",
+                [
+                    str(TOOLS_DIR / "revoke-lease.py"),
+                    "--runtime",
+                    "claude",
+                    "--reason",
+                    "pre-compact",
+                ],
+            ), patch.dict(os.environ, environment, clear=True), redirect_stderr(
+                io.StringIO()
+            ), self.assertRaises(SystemExit) as raised:
+                runpy.run_path(str(TOOLS_DIR / "revoke-lease.py"), run_name="__main__")
+            self.assertEqual(raised.exception.code, 2)
 
     def test_gate_entrypoint_denies_when_identity_environment_is_absent(self) -> None:
+        # Deliberately NOT changed alongside its revoker twin above. The asymmetry is
+        # intentional: the gate's deny-on-absent is the authorization path and is
+        # load-bearing, so absent identity must fail closed here. The revoker's rc=2
+        # was inert in the same case (no session id means no broker call is possible),
+        # which is why only the revoker moved under D29. Do not "restore symmetry".
         class Stdin:
             buffer = io.BytesIO(b'{"tool_name":"Bash"}')
 
@@ -703,8 +742,11 @@ class LeaseRevocationTest(unittest.TestCase):
             "MOSAIC_RUNTIME_GENERATION": "1",
         }
         malformed_session = {**good, "MOSAIC_LEASE_SESSION_ID": "not-a-session"}
+        # D29 exemption: the `({}, ...)` case was removed from this list. An empty
+        # environment is absence-of-lease, not an identity/reply/transport failure, and
+        # its correct result is no-op success (pinned in revoke_noop_unittest.py). The
+        # five cases below are all machinery-present failures and stay fail-closed.
         cases = [
-            ({}, lambda *_args: {"ok": True, "state": "UNVERIFIED"}),
             (malformed_session, lambda *_args: {"ok": True, "state": "UNVERIFIED"}),
             (good, lambda *_args: {"ok": False, "state": "UNVERIFIED"}),
             (good, lambda *_args: {"ok": True, "state": "VERIFIED"}),