test: isolate ordinary unit runs from ambient credentials and provider I/O

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa

tests/test_workload_join.py

@@ -1,5 +1,7 @@
 """Explicit lane-to-workload join tests (WARDEN-WP-0032 / RMGR-WP-0010-T06)."""
 from pathlib import Path
+import hashlib
+import json
 
 import yaml
 
@@ -10,7 +12,8 @@ ROOT = Path(__file__).resolve().parents[1]
 
 
 def test_repo_catalog_uses_only_explicit_workload_references():
-    report = build(ROOT / "registry/routing/catalog.yaml", Path.home())
+    report = build(ROOT / "registry/routing/catalog.yaml",
+                   ROOT / "tests/fixtures/workload-coverage")
     assert report["ok"] is True
     assert len(report["resolved"]) == 4
     assert len(report["unknown"]) == 22
@@ -67,3 +70,14 @@ def test_invalid_exact_deployable_resolves_unknown(tmp_path):
     assert not report["resolved"]
     assert report["unknown"][0]["lane"] == "x"
     assert "deployable" in report["unknown"][0]["reason"]
+
+
+def test_public_workload_projection_matches_provenance():
+    base = ROOT / 'tests/fixtures/workload-coverage'
+    provenance = json.loads((base / 'provenance.json').read_text())
+    expected = {'rapp-core-hub', 'rapp-issue-core', 'rapp-qonto'}
+    assert len(provenance) == len(expected)
+    assert {row['repo'] for row in provenance} == expected
+    for row in provenance:
+        projection = base / row['repo'] / 'declarations/rapp.yaml'
+        assert hashlib.sha256(projection.read_bytes()).hexdigest() == row['projection_sha256']