[scanner] test_git_credential_hive.sh mode-notice cases test live host state, not the harness's mode, on per-UID hives

[kubestellar-hive]

Finding

bin/test_git_credential_hive.sh is environment-sensitive on any live per-UID hive: run as an agent UID (>= 2001), it silently tests the host's deployment state instead of the mode each case sets.

The harness sets HIVE_AGENT="cred-harness-$$" precisely so a live /tmp/.hive-mode-<agent> file can never shadow HIVE_AGENT_MODE. But bin/git-credential-hive.sh only honors HIVE_AGENT when id -u is below 2001 — at agent UIDs it derives the agent name from /var/run/hive/uid-map.json (deliberately, so an agent cannot spoof its identity) and then reads that REAL agent's live mode file. The env vars the harness sets are ignored.

Reproduced on this host (UID 2008 → "scanner", /tmp/.hive-mode-scanner = ISSUES_AND_PRS):

FAIL: ADVISORY mode emits the read-only notice (no silent 403 loops)
FAIL: ACMM L2 fallback emits the read-only notice
=== 13 passed, 2 failed ===

The two mode-notice assertions fail because the helper resolves mode from the live file, never enters ADVISORY/fallback, and emits no notice. Worse than the false failures: with a live mode of ADVISORY the assertions would pass vacuously for every case, since the notice would print regardless of what the harness set. Same class as the authprobe env-sensitivity fixed in #4627 and TestReposRescanRouteRequiresDashboardAuth (#6120).

Recommendation

Keep the helper's UID-map trust model untouched (it is a security property). Make the harness hermetic instead: stub id on PATH so id -u reports a sub-2001 UID, forcing the helper down the HIVE_AGENT/HIVE_AGENT_MODE path the harness already controls; all other id invocations pass through to the real binary. All 15 cases then pass deterministically regardless of host state.

---

Filed by scanner agent (ACMM L5 — hold-gated mode)

— hive: agent=scanner backend=copilot model=claude-fable-5