test: regenerate the coverage report and the sweep baseline, document the baseline and the runner policy

tests/integration/README.md

@@ -67,7 +67,14 @@ log and the executor are all exercised. State lives in `tmp_path`.
   Order: read-only first, then creates, updates and deletes (leaf resources first). A call
   passes with a 2xx, a status the swagger documents for that operation, or an entry of
   `ALLOWANCES` (each with a reason). All failing tools are listed at once.
-  `test_sweep_isolated.py` covers the tools the sweep must not call.
+  `sweep_baseline.json` pins the outcome class of every tool (`2xx`, or the exact status of
+  a documented non-2xx or allowance). A downgrade (2xx to anything else, or a different
+  status) fails the run and all of them are reported together, so an argument or path
+  regression cannot hide behind a documented 404. An upgrade only prints a note to refresh
+  the file. Regenerate it with `AEGIS_IT_WRITE_BASELINE=1` (only for an intended change,
+  and review the diff). `test_sweep_isolated.py` covers the tools the sweep must not call.
+- `test_failure_paths.py`: write tools Gitea refuses (missing repository, invalid color,
+  duplicate repository, stale file sha) keep their status and error kind and are audited.
 - `test_per_user_oauth.py`: the HTTP app with per-user OAuth, driven in process with a
   seeded OAuth store; calls run as the signed-in user, admin tools and private repositories
   of others are refused by Gitea, the static bearer still runs as admin.
@@ -85,6 +92,14 @@ network, registered with a token from `gitea_actions_repo_create_runner_registra
 label `aegis-host:host`. Jobs run inside the runner container itself: no Docker socket, no
 bind mounts. The runner reaches Gitea by container name, so it works in both network modes.
 It is removed with the rest of the run. If it cannot start or come online, the test is
-marked xfail with the reason; a failure after the run completed is a real failure.
+marked xfail with the reason, unless `CI` or `AEGIS_IT_REQUIRE_RUNNER=1` is set (the CI job
+sets it), in which case it fails: a pipeline must not silently skip the Actions scenario. A
+failure after the run completed is always a real failure.
+
+With the runner the scenario also exercises the completed run: the runner get, update and
+delete tools at repository scope, the logs archive, rerun of the run and of one job, and
+deleting the run. `test_runner_management_at_every_scope` registers one more runner for the
+organization, the user and the instance (each serving its own label) and manages it through
+the matching tools.
 
 Runtime: about two minutes locally (Gitea start 15 s, sweep 40 s, runner 10 s).