identity-provisioner: platform group boundary test without pytest

The journeys workflow runs unittest in python:3.12-slim, which has no pytest;
this module failed to import there since e861f63 (2026-10-14).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56

identity-provisioner/tests/test_platform_group_boundary.py

@@ -1,27 +1,31 @@
 """Service group operations must never reach platform IAM groups."""
+import unittest
 from unittest.mock import Mock
 
-import pytest
-
 from provisioner import LLDAPProvisioner, dispatch
 
 
-@pytest.mark.parametrize("path", ["/v1/groups/ensure", "/v1/groups/revoke"])
-@pytest.mark.parametrize("group", [
-    "net-kingdom-admins", "net-kingdom-users", "net-kingdom-future-role",
-])
-def test_platform_groups_refused_before_directory_login(path, group):
-    provider = LLDAPProvisioner(
-        base_url="https://directory.invalid", admin_password="synthetic-fixture",
-    )
-    provider._login = Mock(side_effect=AssertionError("must not contact directory"))
-    payload = {
-        "groups": ["activity-core-operators", group],
-        "members": {group: ["agent-codex"]},
-        "idempotency_key": "platform-boundary-test",
-        "correlation_id": "source-test",
-        "delete_if_empty": True,
-    }
-    with pytest.raises(ValueError, match="reserved"):
-        dispatch(provider, path, payload)
-    provider._login.assert_not_called()
+class PlatformGroupBoundaryTests(unittest.TestCase):
+    # Standard library only: the CI image (python:3.12-slim) has no pytest.
+    def test_platform_groups_refused_before_directory_login(self):
+        for path in ("/v1/groups/ensure", "/v1/groups/revoke"):
+            for group in ("net-kingdom-admins", "net-kingdom-users", "net-kingdom-future-role"):
+                with self.subTest(path=path, group=group):
+                    provider = LLDAPProvisioner(
+                        base_url="https://directory.invalid", admin_password="synthetic-fixture",
+                    )
+                    provider._login = Mock(side_effect=AssertionError("must not contact directory"))
+                    payload = {
+                        "groups": ["activity-core-operators", group],
+                        "members": {group: ["agent-codex"]},
+                        "idempotency_key": "platform-boundary-test",
+                        "correlation_id": "source-test",
+                        "delete_if_empty": True,
+                    }
+                    with self.assertRaisesRegex(ValueError, "reserved"):
+                        dispatch(provider, path, payload)
+                    provider._login.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()