test: isolate ordinary unit runs from ambient credentials and provider I/O

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa

tests/fixtures/workload-coverage/rapp-core-hub/declarations/rapp.yaml

@@ -0,0 +1,15 @@
+# Public declaration projection for the published coverage snapshot; not live evidence.
+rapp_id: rapp-core-hub
+workload_identity:
+  name: core-hub
+composition:
+  member_repos:
+  - deployables:
+    - core-hub-api
+    - core-hub-migrate
+    - hub-core-candidate
+    - hub-core-candidate-migrate
+    - repository-classification-publisher
+data_classification: confidential
+criticality: high
+readiness_state: verified