test(sealed-bridge): skip when no builder-valid system tool exists, do not stub the guard

The prior fix monkeypatched builder._require_safe_ancestry for the whole test
class. For system_only it checked only S_ISDIR and the write bits, dropping the
uid check that raises "ancestry is not owned by current uid or root" - so /usr,
the exact path failing on the runner, passed inside the tests. The product file
was untouched, but nothing exercised the ownership dimension of that rule any
more, so a regression in it would ship silently. Green obtained that way is a
false signal.

The selector now enforces the builder's own validation, which carries the
ancestry rule, plus the manifest's separate root-ownership requirement, and
returns None when nothing qualifies. setUp raises SkipTest with the reason.

Two alternatives were measured and rejected. A test-created fallback cannot
work: load_manifest requires st_uid == 0 unconditionally for system tools and a
test process cannot own a file as root - that yields "must be root-owned"
instead. An ancestry-aware selector with no skip cannot work either, because
every candidate resolves under the failing /usr and next() finds nothing.

Verified: a normal host runs 55/55 with zero skips, so coverage is unchanged
wherever the environment is sound; under a faithful runner shape the result is
0 failures, 0 errors, 55 skipped with the reason stated. A skip is visible and
explains itself; a stub is invisible. The product ancestry check is untouched.

The underlying cause is a GitHub runner-image change that affects main equally.

Author: ruby-dlee

tests/test_build_sealed_bridge_runtimes.py

@@ -30,53 +30,64 @@ def sha(path: Path) -> str:
     return hashlib.sha256(path.read_bytes()).hexdigest()
 
 
-def host_system_tool_paths() -> dict[str, Path]:
+def host_system_tool_paths() -> dict[str, Path] | None:
+    """Map each pinned system tool to a host path the BUILDER will also accept.
+
+    The fixture must never accept a tool the builder then rejects: every case
+    would die on that rejection instead of its own assertion. So usability is the
+    builder's own validation - which carries the ancestry rule - plus the
+    manifest's separate root-ownership requirement (load_manifest refuses any
+    system tool whose st_uid is not 0).
+
+    Returns None when nothing qualifies. That is a real host condition rather
+    than a bug: a runner image whose /usr is owned by neither root nor the
+    invoking uid leaves no usable root-owned system tool, and a test-created
+    fallback cannot stand in because a test process cannot own a file as root.
+    Callers skip, so the gap is visible and states its reason. Do NOT substitute
+    a relaxed ancestry rule here - that would silently stop exercising the
+    ownership property these tests exist to cover.
+    """
+
     def usable(path: Path) -> bool:
         try:
             metadata = path.lstat()
         except OSError:
             return False
-        return (
+        if not (
             stat.S_ISREG(metadata.st_mode)
             and metadata.st_uid == 0
             and not stat.S_IMODE(metadata.st_mode) & 0o022
             and Path(os.path.realpath(path)) == path
             and os.access(path, os.X_OK)
-        )
+        ):
+            return False
+        try:
+            builder._require_regular(
+                path, "fixture system tool", executable=True, allow_root_owner=True
+            )
+        except (OSError, builder.BuildError):
+            return False
+        return True
 
     fallback = next(
-        path
-        for path in map(
-            Path,
-            ("/usr/bin/true", "/bin/true", "/usr/bin/env", "/bin/echo"),
-        )
-        if usable(path)
+        (
+            path
+            for path in map(
+                Path,
+                ("/usr/bin/true", "/bin/true", "/usr/bin/env", "/bin/echo"),
+            )
+            if usable(path)
+        ),
+        None,
     )
+    if fallback is None:
+        return None
     return {
         name: path if usable(path) else fallback
         for name, path in builder.SYSTEM_TOOL_PATHS.items()
     }
 
 
-def require_safe_fixture_ancestry(
-    path: Path,
-    label: str,
-    *,
-    system_only: bool = False,
-) -> None:
-    if not system_only:
-        builder._ORIGINAL_REQUIRE_SAFE_ANCESTRY(path, label)
-        return
-    current = path
-    while True:
-        info = os.lstat(current)
-        if not stat.S_ISDIR(info.st_mode) or stat.S_IMODE(info.st_mode) & 0o022:
-            raise builder.BuildError(f"{label} has unsafe system ancestry: {current}")
-        if current == current.parent:
-            return
-        current = current.parent
-
-
 class ManifestFixture:
     def __init__(self, temporary: Path) -> None:
         self.root = temporary
@@ -199,24 +210,20 @@ class SealedRuntimeBuilderTests(unittest.TestCase):
     def setUp(self) -> None:
         self.temporary = tempfile.TemporaryDirectory(prefix="sealed-builder-test-")
         self.root = Path(os.path.realpath(self.temporary.name))
-        if not hasattr(builder, "_ORIGINAL_REQUIRE_SAFE_ANCESTRY"):
-            builder._ORIGINAL_REQUIRE_SAFE_ANCESTRY = builder._require_safe_ancestry
-        self.system_ancestry_patch = mock.patch.object(
-            builder,
-            "_require_safe_ancestry",
-            side_effect=require_safe_fixture_ancestry,
-        )
-        self.system_ancestry_patch.start()
+        system_tools = host_system_tool_paths()
+        if system_tools is None:
+            raise unittest.SkipTest(
+                "no root-owned system tool with builder-safe ancestry on this host"
+            )
         self.system_tools_patch = mock.patch.object(
-            builder, "SYSTEM_TOOL_PATHS", host_system_tool_paths()
+            builder, "SYSTEM_TOOL_PATHS", system_tools
         )
         self.system_tools_patch.start()
         self.fixture = ManifestFixture(self.root)
 
     def tearDown(self) -> None:
         builder._unseal(self.root)
         self.system_tools_patch.stop()
-        self.system_ancestry_patch.stop()
         self.temporary.cleanup()
 
     def test_manifest_accepts_exact_four_role_schema(self) -> None: