Merge the duplicated unit-test setups across natmap and auto-discover

[FAZuH]

Part of the whole-repo test-suite audit (2026-09-30).

What to build

The repeated Arrange block replaced by the make_* helper the guidelines already mandate, so each test keeps only its own scenario.

Findings

• crates/natmap/src/daemon.rs:1090,1098,1119,1140,1161 — five tests, each restating the same 12-line state.write().await.mapping.insert(DockerPortMap::new(...)) block. A make_state(&[("alpha", 8080, "10.0.0.2")]) helper plus one table.
• crates/natmap/src/daemon.rs:1228,1247,1266 — three reconcile_addr_* tests, each with two five-line DockerPortMapRequest literals.
• crates/auto-discover/src/daemon.rs:1042-1365 — ten sync_service_* tests sharing an identical eight-line Arrange (tempdir plus two fakes plus make_daemon plus make_resolved), differing only in the ResolvedPortType variant.
• crates/auto-discover/src/consul.rs:389,437 — build_consul_service builds a 20-line ResolvedService literal and makes 12 assertions in one test; build_consul_service_udp_check copies the literal. One make_resolved(port_type, protocol) helper plus a table of (port_type, expected_meta).
• src/cmd/dns_parser.rs:189-254,518-528 — the highest test-to-production ratio in the repo, 52 tests for 181 production lines. Eight parse_zone_*_record tests assert the same three fields with a different rtype string; can_proxy_a_record, can_proxy_aaaa_record and can_proxy_cname_record are three tests for one matches!(rtype, "A" | "AAAA" | "CNAME").

Acceptance criteria

• Every shared fixture is a make_* private helper at the top of its test module, per standards.md §7.4
• Each test contains its own scenario, not its own copy of the setup
• One concept per test: the consul.rs 12-assertion test becomes a table or splits
• Test names follow standards.md §3.6
• cargo test -p lab-ops_natmap --lib, cargo test -p lab-ops_auto-discover --lib and cargo test -p lab-ops --lib pass
• No test loses coverage: the same inputs and the same expected outputs are asserted

Blocked by

None (can start immediately).

Estimated: -30 tests, -390 lines.

[FAZuH]

Resolved on v0.2, not on main.

The closing keyword in aa71cca cannot fire: GitHub only auto-closes from commits that reach the default branch, and this work is deliberately parked on the v0.2 version branch until that version is cut. Closing by hand instead.

Commit	What
aa71cca	#46 — the make_* helpers and the flat-repeat tables
acca2d6	merge of test/shared-fixtures into v0.2
16f854a	merge of the parked refactor/audit-cut into v0.2
08f0221	fix: the two proxy_on: None, lines the refactor's deletion no longer reached after #46 split the module

Verified on the merged tree, ./dev.sh test: 426 passed, 0 failed, 10 targets, exit 0. Lib counts for #46 itself: natmap 163 (unchanged), auto-discover 67 → 69, root 65 → 53; full suite 442 → 432, the net −10 being exactly those two deltas.

Coverage was checked by mutation rather than by assertion — 8 mutants injected across the four sites, all 8 caught.

Two calls that went against the ticket's suggestion

• consul.rs: the 12-assertion test was split, not table-driven. It mixed three unrelated concepts, so one table needed a per-row expected-meta map restating the production match.
• auto-discover/daemon.rs sync_service_*: helper only, no table. The issue said these differ "only in a ResolvedPortType variant"; they differ in target kind, fake flag, and which surface is asserted, so a table would have needed a not-applicable sentinel per assertion kind.