[quality] test: pin degraded-boot branches of MergeLayersYAML/MergeLayersWithFallback + PauseIsOperatorOwned

[kubestellar-hive]

Test Improvement

Adds src/pkg/config/layers_yaml_boot_branches_test.go pinning the previously untested degraded-boot branches in src/pkg/config/layers_yaml.go and the pause-ownership predicate in src/pkg/config/config.go:

• MergeLayersYAML (58.8% → 100%):
  • unparsable seed returns an error instead of booting an empty config
  • absent overlay (first boot) uses the seed with no rejection reported
  • malformed non-YAML overlay (distinct from parseable-but-implausible, which layers_guard_test.go already covers) falls back to the seed with OverlayRejected and a parse-error reason
• MergeLayersWithFallback (→ 95.5%): an unparsable last-good backup keeps the seed and leaves LastGoodUsed false — no phantom recovery
• seedHasIsPublic (→ 100%): unparsable probe assumes hub.is_public present, preserving fleet visibility semantics
• PauseIsOperatorOwned (0% → 100%): the ACMM pack visibility sweep immunity marker (ACMM pack apply re-pauses operator-created non-pack agents on every boot #5706) matches exactly operator — empty/pack/case-variant owners do not grant immunity

The only remaining uncovered branch in MergeLayersWithFallback is the seed re-unmarshal failure at layers_yaml.go:113, which is unreachable when MergeLayersYAML has already parsed the same bytes.

Cluster claimed: src/pkg/config/layers_yaml.go (MergeLayersYAML, MergeLayersWithFallback, seedHasIsPublic) and src/pkg/config/config.go (PauseIsOperatorOwned). Disjoint from open PRs #5697 (pkg/hub wrapkey), #5705/#5728 (pkg/hub alerts/remediation), #5720 (scheduler reviewer-lane), #5711 (dashboard contribute activity), and the open lease-registry persist test PR.

Verified: go test ./pkg/config/ green (94.3% pkg coverage).

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign danathar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[clubanderson]

Reviewed tests against pkg/config behavior rather than just accepting the assertions. The pinned degraded-boot branches match the documented MergeLayersYAML/MergeLayersWithFallback contracts (seed parse fails closed, malformed overlay falls back loudly, unparsable last-good is ignored) and PauseIsOperatorOwned is exact-marker only. go build ./... and targeted pkg/config tests pass.

[kubestellar-prow]

LGTM label has been added.

Details

Git tree hash: c112364e714680c1d5391dcc625926560df2a56b

[github-actions]

Thank you for your contribution! Your PR has been merged.

Check out what's new:

• KubeStellar Console — Live multi-cluster dashboard
• Marketplace — Community extensions
• Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey