test: isolate ordinary unit runs from ambient credentials and provider I/O

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa

tests/fixtures/workload-coverage/provenance.json

@@ -0,0 +1,20 @@
+[
+  {
+    "repo": "rapp-core-hub",
+    "source": "retained public snapshot from warden-1.3-kernel-fixes-r1 test preparation",
+    "source_sha256": "98e81fb1116aa0ac9dc1a3e7aef9dd87c6d2110d98d46fbfca2f76eec8f3a77b",
+    "projection_sha256": "9ce902da0c77809f1094a634244652835b162f59682e9fa6923d8c8aa4ed4a3c"
+  },
+  {
+    "repo": "rapp-issue-core",
+    "source": "retained public snapshot from warden-1.3-kernel-fixes-r1 test preparation",
+    "source_sha256": "0425c9fe84e26b359b2a35fc37ef8fcb781de1aaa6229c59fcd246ee523514a5",
+    "projection_sha256": "a1956deecf2f0fbca44549e5ea5e8f1c4b74ebf91a9482c64c982491af0d923b"
+  },
+  {
+    "repo": "rapp-qonto",
+    "source": "retained public snapshot from warden-1.3-kernel-fixes-r1 test preparation",
+    "source_sha256": "6279dc2f3ab09519dffa1ceeedb2095f1182960e0106109a87aa5c0052446883",
+    "projection_sha256": "15aa9809e8d6a120c516be5ce9adfb72c00382140c171e791083ad117f503b3f"
+  }
+]

tests/fixtures/workload-coverage/rapp-core-hub/declarations/rapp.yaml

@@ -0,0 +1,15 @@
+# Public declaration projection for the published coverage snapshot; not live evidence.
+rapp_id: rapp-core-hub
+workload_identity:
+  name: core-hub
+composition:
+  member_repos:
+  - deployables:
+    - core-hub-api
+    - core-hub-migrate
+    - hub-core-candidate
+    - hub-core-candidate-migrate
+    - repository-classification-publisher
+data_classification: confidential
+criticality: high
+readiness_state: verified

tests/fixtures/workload-coverage/rapp-issue-core/declarations/rapp.yaml

@@ -0,0 +1,11 @@
+# Public declaration projection for the published coverage snapshot; not live evidence.
+rapp_id: rapp-issue-core
+workload_identity:
+  name: issue-core
+composition:
+  member_repos:
+  - deployables:
+    - issue-core
+data_classification: confidential
+criticality: high
+readiness_state: verified

tests/fixtures/workload-coverage/rapp-qonto/declarations/rapp.yaml

@@ -0,0 +1,11 @@
+# Public declaration projection for the published coverage snapshot; not live evidence.
+rapp_id: rapp-qonto
+workload_identity:
+  name: qonto
+composition:
+  member_repos:
+  - deployables:
+    - rapp-qonto
+data_classification: restricted
+criticality: critical
+readiness_state: verified