test: one creds guard, and a net for the modules that forget it

[ligon]

Four PRs went red in a single day for the same non-reason — #625, #632, #641, #644. Each cost a diagnosis cycle to establish the failure had nothing to do with the change under review.

The pattern

A newly added test module builds real country data → DVC → S3. The CI unit-tests job runs deliberately data-free (LSMS_SKIP_AUTH=1, no secrets; only data-tests carries them), so it raises NoCredentialsError regardless of whether the logic is correct.

Most data-dependent tests already guard for this — 649 of them skipped cleanly in the same run that #625 errored in. The new modules simply lacked the guard.

#644 is the instructive one. It catches NoCredentialsError and re-raises it as:

Ethiopia/2011-12 cluster_features raised NoCredentialsError ... the geo file most likely spells its coordinate columns differently in this wave.

A confident, specific, and completely wrong diagnosis — pointing a reviewer at a data bug that does not exist.

Why it kept happening

There was no tests/conftest.py at all. So the same _aws_creds_available() helper had been copy-pasted into three modules, each noting centralising it was wanted "but not in a CI-red hotfix". This is that PR.

Adds the helper, a requires_s3 mark, and a pytest_runtest_makereport wrapper converting a missing-credentials failure into a skip — covering the setup phase too, since the usual shape is a module-scoped fixture building a country, where one error takes out the whole module at once.

It cannot hide a real failure

The conversion is conditioned on the environment, not the exception:

	creds absent	creds present
NoCredentialsError	skipped	failed
assert 1 == 2	failed	failed

Verified in all four cells rather than assumed — a test silently skipped everywhere is worse than one red somewhere.

The subtlety that made this hard to verify (now documented in the file)

lsms_library/countries/.dvc/s3_creds is not tracked in git — it is written at import time by the auto-unlock. So a fresh git worktree looks credential-free until the first import silently creates it, after which the guard reads True. Only LSMS_SKIP_AUTH=1 reproduces CI’s actual state.

My first three attempts to verify this hook "failed" for precisely that reason, and the fourth only worked once I deleted the file and set the flag. That is recorded in the docstring so the next person does not lose the same hour.

Merge order

This should go in before the rebased country PRs — then their remaining red clears without per-module edits.