fix(SEC-004): stop shipping pytest in the production image - #122

Closes #121.

Problem

requirements.txt declared pytest as a runtime dependency:

# requirements.txt:45-46
# Test runner.
pytest

Dockerfile:46-48 installs requirements.txt (with constraints.txt) and nothing else, so the test runner and its dependency tree were baked into the deployed image — on both the Render web service and the daily-scan cron.

It was already declared in requirements-dev.txt:5, so this was a duplicate that bought nothing and only widened the production surface.

Fix

Remove the block, and add test_developer_tools_stay_out_of_the_runtime_requirements so it cannot drift back.

The guard deliberately covers the whole class of verification tooling — pytest, pytest-cov, ruff, bandit, pip-audit, mypy, pre-commit — and makes two assertions per name:

1. absent from requirements.txt, and
2. still present in requirements-dev.txt.

The second half matters: without it, a future "fix" could satisfy the guard by deleting the dependency outright and quietly breaking CI's ability to run the gates.

Verification

• Re-added pytest to requirements.txt and confirmed the new guard fails, then removed it again.
• pytest -q --cov=... --cov-fail-under=89 — 2035 passed, 1 skipped, 89.97%
• ruff check, compileall — clean
• git diff origin/main HEAD -- constraints.txt pyproject.toml — empty (AGENTS.md §7)

The constraints.txt pin for pytest is untouched and still correct: constraints only pin versions for whatever is actually being installed, and CI installs both requirements files (pip install -r requirements.txt -r requirements-dev.txt -c constraints.txt). test_supply_chain_policy.py's existing assertion that pytest== appears in constraints.txt is unaffected and still passes.

Noted, deliberately not fixed here

requirements-optional.txt has a related but separate problem — bare TA-Lib and pandas_ta with no pins, absent from constraints.txt, so pip_audit -r constraints.txt never audits them. Compounding it, no test exercises the accelerated branches they enable (backend/indicators.py:581,601,621,660,708,771,1016,1118) because CI never installs the packages. That deserves its own ticket, including the question of whether the pandas_ta path should simply be deleted.

🤖 Generated with Claude Code