fix: make clean-room tests environment-independent

[magetsu002]

Summary

Fix deterministic clean-room certification failures that occurred in interactive Codespaces and filesystems with inherited permission behavior.

The change makes tests independent of ambient terminal color settings and explicitly normalizes generated SSH fixture-key permissions.

Change type

• Bug fix
• Feature
• Security hardening
• Refactor
• Documentation
• Dependency update
• CI / tooling

Motivation

The V1.1 test suite passed in CI but reproduced six failures in a fresh interactive GitHub Codespace:

• Three doctor-output tests received ANSI-formatted output while asserting plain text.
• Three initialization tests rejected generated private-key fixtures because their effective permissions were not guaranteed to be owner-only.

After disabling ambient color, the output failures disappeared. Explicitly normalizing fixture-key permissions resolved the remaining failures.

This repair ensures clean-room certification behaves consistently across CI, interactive terminals, Codespaces, and filesystems with inherited ACL or permission behavior.

Related issue: None.

Implementation details

• Explicitly disable ANSI color in doctor formatter tests.
• Set generated SSH private-key fixtures to mode 0600.
• Set generated SSH public-key fixtures to mode 0644.
• Preserve the production requirement that administrator private keys must be safe owner-only regular files.
• Limit changes to test fixtures and test-environment determinism.

No runtime implementation, authorization policy, remote execution path, or key-validation rule was weakened.

Security impact

Does this change affect any of the following?

• Authorization decisions
• Capability permissions
• Remote execution boundary
• SSH transport behavior
• Key handling or cryptography
• Audit logging
• Rollback behavior
• No security impact

If yes, explain:

No production security behavior changed. The strict private-key permission validation remains unchanged. Only generated test fixtures are normalized to the permissions already required by production code.

Validation performed

Commands/tests executed:

• npm test
• npm run release:check
• npm run security

Additional validation:

• 219/219 tests passed.
• Package inspection passed.
• Documentation checks passed.
• Lockfile verification passed.
• Workflow action-pin verification passed.
• Read-only wrapper verification passed.
• Security scan checked source files and Git history successfully.
• npm audit --omit=dev --audit-level=high reported 0 vulnerabilities.
• git diff --check passed.

Security considerations

What security assumptions changed?

None.

What prevents abuse or regression?

Production private-key validation still rejects symlinks, non-regular files, and private keys with group or other permission bits.

The test fixtures now explicitly reproduce the required secure permission state instead of depending on ambient filesystem defaults.

Doctor-output tests explicitly select plain output, preventing terminal environment variables or TTY detection from changing assertion behavior.

Were existing protections preserved?

Yes. Authorization, capability enforcement, SSH host verification, remote confinement, audit integrity, rollback behavior, and strict key handling remain unchanged.

Compatibility

Does this change affect:

• Existing configurations
• Existing installations
• CLI commands
• MCP protocol behavior
• No compatibility impact

Documentation

• Documentation updated
• Operator workflow updated if needed
• No documentation changes required

Final checklist

• Tests pass
• Security checks pass
• No secrets or private keys included
• No security controls weakened
• Backward compatibility considered
• Ready for review