test(bats): filter _acq_coreutils_path to absolute dirs, assert absence premise

[mogul]

Context

Follow-up to #392 (merged). Review feedback on the _acq_coreutils_path test helper introduced there:

_acq_coreutils_path still unions dirname of 12 tools without filtering non-absolute entries — command -v printf hits the builtin and yields ., so the current directory ends up on the "just coreutils" PATH (reproduced: a stray msb file in the CWD becomes callable). And on a Homebrew-coreutils host the union pulls in /opt/homebrew/bin — the same dir as msb/sbx — so the test meant to prove "the backend CLI is provably absent" can silently have it present. Filter to absolute paths, and assert the premise (command -v msb; assert_failure).

This is the small follow-up in the spirit of #393's repair of vacuous assertions.

Plan / Changes

• test/bats/helper.bash — _acq_coreutils_path now skips any command -v result that is not absolute (/-prefixed) before taking its dirname. Shell builtins like printf resolve to a bare name whose dirname is ., which would otherwise put the CWD on the narrowed PATH.
• test/bats/20-backend-resolution.bats — the self-repair test now asserts its premise: after narrowing PATH to coreutils, run command -v msb; assert_failure. If the narrowed PATH ever exposes the backend, the test fails loudly instead of passing hollowly.

Verification

$ ./scripts/test-acq-bats
... 1..345 all ok (exit 0)

$ ./scripts/test-acq-bats test/bats/20-backend-resolution.bats
1..10 ... ok 9 self-repair: backend in ~/.local/bin is detected + hinted (premise now asserted)

$ shellcheck --severity=warning test/bats/helper.bash
(clean)

Rollback

Revert this commit; the helper returns to unioning all command -v dirnames.

Security Impact

None. Test-only change; hardens a test premise. No runtime/auth/data-handling surface.

AI-assisted (OpenCode).

[wz-gsa]

Adversarial review — LGTM, verified both fixes directly

This is the follow-up I filed as #396; both asks are addressed correctly.

Fix 1 (. on PATH): ran the patched `_acq_coreutils_path` on this host — before: `…:/bin:/usr/bin:.`; after: `/Users/…/.local/bin:/bin:/usr/bin`, no `.` entry. Confirmed the filter is surgical, not overbroad: real tools (`cat`/`rm`/`mkdir`) still resolve correctly from the narrowed PATH afterward — it drops only the builtin-derived bare name (`printf` → `.`), nothing else.

Fix 2 (assert the premise): `run command -v msb; assert_failure` is placed at the one call site whose premise depends on it (`self-repair: backend in ~/.local/bin is detected + hinted`) — correctly NOT added to the sibling `does not shadow a system backend already on PATH` test, which deliberately puts a backend on PATH.

Test-only change, no runtime/auth surface. `case "$_d" in /*) ;; *) continue ;; esac` is portable POSIX glob matching, no bashisms. Approve.

One housekeeping note: this closes #396 but doesn't reference it — worth adding `Closes #396` (or I'll close it manually once this merges).

AI-assisted (OpenCode).

[mogul]

Closes #396