ci: gate the ~1,830 tests that had no job, and fix the 6 that blocked it

[ProtocolWarden]

~1,830 tests had no CI job at all — everything under tests/maintenance/, tests/observer/, tests/verdicts/, the rest of tests/integration/, and the top-level tests/test_*.py.

Two dedicated jobs already exist for single files that rotted unnoticed (tests/test_pr_review_watcher.py, tests/integration/reviewer) — each added after that suite had drifted. This generalises the fix instead of waiting for the next one.

What the gap cost, concretely

• feat(forgejo): settings and backend selection for the board factory #509 shipped a regression that broke tests/maintenance/ — found a week later by hand in fix(adapters): the board factory rejected a settings double #513.
• feat(board): delete the Plane adapter — the migration is complete #521 merged a brand new failing test in tests/test_dependency_check.py. CI green, reviewer verdict SUCCESS, main red until test(dependency-check): fix the assertion that left main red #522.
• tests/test_proposer_entrypoint.py had been failing since the board-seam migration weeks earlier. Nothing noticed.

The 6 blockers were not what they looked like

Four were bad mocks, not bugs. They raised FileNotFoundError("message") — with no errno. pathlib's predicates swallow only ignorable errnos (ENOENT, ENOTDIR, EBADF, ELOOP), so an errno-less error escapes is_file()/is_dir(), which a real vanished path never does. Verified identically on 3.11 and 3.12: deleting a directory mid-scan makes glob() return []. The mocks were testing CPython's exception plumbing, not the collectors' guards.

My first attempt "fixed" production by guarding the walk against deletion — defending against something that cannot happen — and is reverted in this branch.

One was a real gap the bad mock was hiding. EACCES and EIO are not ignorable, so a log directory that becomes unreadable (rather than deleted) does raise straight out of the walk and take the collector with it. latest_matching_file now guards for OSError, with the distinction written down, because "return None when nothing is discoverable" is its contract.

One was a real production bug. custodian_sweep._emit answered zero-findings before its dry-run branch could run, so that branch was unreachable and a dry run reported skipped-zero-findings — the past tense, for work it had not done. Two tests in the same file asserted opposite labels for the same call; the module's own would-comment/would-create convention and the shadowed branch both say would- was intended.

One was a stale patch target — proposer.main.PlaneClient stopped existing at the board migration.

Verification

	result
tests/unit	8623 passed, 0 failed
the new job's exact command	1830 passed, 0 failed
ruff / ty / doctor / audit	clean / 13 baseline / OK / clean

The new job is not added to branch protection's required contexts, so it changes no merge policy directly — but the reviewer's merge gate refuses on any failed check, so a regression here blocks the fleet the same way.

🤖 Generated with Claude Code