fix(cargo-gamma): stabilize Linux publish tests

[martin-kolinek]

🤖 Fixes the Linux test failures behind publish build 40437331.

Root cause

• Redirected-cache security tests created fixtures below the repository target directory. On the containerized Linux agents, the checkout has a non-sticky world-writable ancestor, which the production cache hardening correctly rejects.
• The grandchild control test used a fixed 1.5-second scheduling threshold and failed under release-build agent load.
• The missing Clippy SARIF and SBOM directories were downstream effects of the failed Cargo test task.

Changes

• Create redirected-cache fixtures under the system temporary directory while leaving production permission checks unchanged.
• Replace the wall-clock grandchild assertion with a deterministic release gate.
• Bound the process-helper wait directive with explicit empty-input and timeout failures, and bump its cached fixture name.

Validation

• cargo test -p cargo-gamma-lib --lib exec::workspace::tests on Windows and Linux
• cargo test -p cargo-gamma-process --lib on Windows
• cargo test --release -p cargo-gamma-process --lib on Linux
• just format, just readme, and just spellcheck

[Copilot]

🟡 Changes recommended

The new wait helper directive can block indefinitely (and on empty payload), which can hang CI by leaving orphaned helper processes running when tests fail early.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Stabilizes cargo-gamma Linux publish/test runs by removing environment-sensitive filesystem assumptions in redirected-cache security fixtures and replacing a timing-based grandchild/orphan assertion with a deterministic “release gate” handshake.

Changes:

• Moved redirected-cache test fixtures from the repo target/ tree to the system temporary directory to avoid inheriting unsafe checkout ancestry permissions.
• Reworked the grandchild-orphan control test to use a filesystem “release gate” instead of a fixed wall-clock threshold.
• Bumped the cached cargo-gamma-process test helper fixture name and introduced a new helper directive (wait).

File summaries

File	Description
crates/cargo-gamma-process/src/testing.rs	Adds a new helper directive and bumps the cached helper name used by process-tree tests.
crates/cargo-gamma-process/src/process_tree.rs	Makes the grandchild control test deterministic via a release marker instead of elapsed-time assertions.
crates/cargo-gamma-lib/src/exec/workspace.rs	Creates redirected-cache security fixtures in the system temp directory to avoid unsafe permission inheritance from the repo checkout.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.6%. Comparing base (30f4053) to head (c0d0843).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##            main    #141     +/-   ##
=======================================
- Coverage   97.6%   97.6%   -0.1%     
=======================================
  Files        290     288      -2     
  Lines      65894   64984    -910     
=======================================
- Hits       64351   63450    -901     
+ Misses      1543    1534      -9     

Flag	Coverage Δ
linux	93.5% <100.0%> (-4.1%)	⬇️
linux-arm	93.5% <100.0%> (-4.1%)	⬇️
scheduled	?
windows	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟢 Approval recommended

The changes directly address the stated Linux flake root causes with deterministic fixtures and bounded waits, and the updated tests appear consistent and self-contained.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

The changes are narrowly scoped to test infrastructure/fixtures, address the described Linux flakiness causes deterministically, and include coverage for the newly introduced helper failure mode.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite