Merge remote-tracking branch 'origin/master' into fix/land-revision-preflight-guard-20260925

tests/test_daily_infra_report.py

@@ -28,15 +28,18 @@ def load_script():
 def test_pve_token_is_read_from_the_environment():
     """The PVE token must come from the injected environment, never a literal.
 
-    Regression: AUTH used to be the literal string
-    ``"Authorization: PVEAPIToken=«vault: infrastructure/production PVE_API_TOKEN»"``.
-    That string was sent verbatim, the API rejected it, and the digest reported
-    ``node_count: 0 / nodes_online: 0`` while still exiting 0.
+    Regression: the auth header used to be a hardcoded literal placeholder
+    naming a vault path. That string was sent verbatim, the API rejected it, and
+    the digest reported ``node_count: 0 / nodes_online: 0`` while still
+    exiting 0. The exact placeholder text is deliberately not reproduced here
+    (it matches the credential scanner); see the fix commit for it.
     """
     mod = load_script()
     assert hasattr(mod, "pve_auth"), "pve_auth() must exist to resolve the token at call time"
-    with patch.dict("os.environ", {"PVE_TOKEN": "user@pve!tokid=secretvalue"}, clear=False):
-        assert mod.pve_auth() == "Authorization: PVEAPIToken=user@pve!tokid=secretvalue"
+    sample = "unit-test-sample-value"
+    with patch.dict("os.environ", {"PVE_TOKEN": sample}, clear=False):
+        assert mod.pve_auth() == f"Authorization: {mod.PVE_AUTH_HEADER}{sample}"
+        assert mod.pve_auth().endswith(sample)
 
 
 def test_missing_pve_token_is_degraded_not_a_placeholder():