[quality] make provenance non-Kubernetes regression test hermetic on in-cluster hosts

[kubestellar-hive]

Test Improvement

TestProvenanceReportsSeedWritableOutsideKubernetes (src/pkg/dashboard/api_provenance_test.go) is the #4971 regression test for the non-Kubernetes branch of the config-provenance report. It relied on the test host having neither KUBERNETES_SERVICE_HOST nor a serviceaccount token — so on any hive that itself runs in a pod (in-cluster CI runners, dev hives) IsKubernetesPod() reads true and the test fails deterministically with "reported writable=false outside Kubernetes". Verified failing on a clean checkout on an in-cluster host, passing after this change.

Changes (files/functions claimed):

• src/pkg/config/config.go: add exported SetSATokenFileForTest seam next to saTokenFile (mirrors the existing SetSecretFileRootsForTest pattern) so out-of-package tests can force the non-pod branch. Test seam only — no production behavior change (IsKubernetesPod logic untouched).
• src/pkg/dashboard/api_provenance_test.go (TestProvenanceReportsSeedWritableOutsideKubernetes): clear KUBERNETES_SERVICE_HOST and stub the SA-token path explicitly, matching what config_save_test.go already does in-package.

Disjoint from open hold-gated PR #4032 (proxy auth injection: pkg/proxy, pkg/github, pkg/config/proxy_inject*) — no shared files or functions.

Note: while validating, TestIntegration_SelectTask_PromotionRequiresPR also failed under full-suite load but passes 3/3 in isolation — flaky, tracked separately, not touched here.

Related Issue

None (found during coverage sweep).

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign danathar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Changelog: this PR changes code but does not touch CHANGELOG.md.

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a line under ## Unreleased. If it is a refactor, a
test-only change, or dependency churn, no entry is needed and you can
ignore this.

This is a reminder, not a gate; it never blocks a merge.

[github-actions]

Thank you for your contribution! Your PR has been merged.

Check out what's new:

• KubeStellar Console — Live multi-cluster dashboard
• Marketplace — Community extensions
• Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey