refactor(tests): derive the two duplicated test helpers into tests/helpers.py (#4276)

Derive-first, ahead of the tests shape pay-down. An AST pass over all 2628
definitions under `tests/` found exactly three helper bodies duplicated
across files. Two are real copies and are consolidated here; the third is
not, and is left alone.

`need_tools(*tools)` — byte-identical in three hook-test modules, each
skipping when `jq`/`awk`/`git` is absent from PATH. Now snippet #4277. The
`import shutil` each file carried existed only to serve it and goes with it.

`rule_row(rule_id)` — byte-identical in two integration modules, reading a
Rule back through a SEPARATE session so the assertion is about what Postgres
holds rather than what the writing session's identity map remembers. Now
snippet #4278. Its imports are lazy, because `tests/helpers.py` is imported
by unit tests that have no database, which is the same reason
`plugin_config` defers its service imports.

NOT consolidated: `_side(uid, k, d="")` in test_services_plugin_context and
test_write_path_trigger. The body is identical but it closes over a
module-local `stored` dict, so it is not self-contained and "moving" it
would mean inventing a parameter neither call site wants. That is convention
plumbing — two tests independently writing the same one-line side_effect —
and it is dismissed in the ledger rather than lifted.

Worth recording for the next pass: a repeated NAME is not a family. `_row`
is defined in five modules and only two of those share a body; the other
three (test_list_rows_brief, test_calibration_stamp, test_shape_ledger)
build entirely different objects. Grouping by name would have consolidated
three things that have nothing in common.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

tests/test_integration_rule_verification.py

@@ -23,7 +23,7 @@ import pytest_asyncio
 from scribe.models import async_session
 from scribe.models.rulebook import Rule
 from scribe.services import rulebooks as rulebooks_svc
-from tests.helpers import ensure_user
+from tests.helpers import ensure_user, rule_row
 
 pytestmark = [pytest.mark.integration, pytest.mark.usefixtures("_dispose_engine")]
 
@@ -57,13 +57,8 @@ async def constraint():
     return {"uid": uid, "rule": rule.id}
 
 
-async def _row(rule_id: int) -> Rule:
-    async with async_session() as s:
-        return await s.get(Rule, rule_id)
-
-
 async def test_the_check_and_its_expiry_persist(constraint):
-    row = await _row(constraint["rule"])
+    row = await rule_row(constraint["rule"])
     assert row.verify_with == "read the workflow's shell setting"
     assert row.expires_when == "the runner can be given a bash shell"
     assert row.verified_at is not None
@@ -79,7 +74,7 @@ async def test_an_empty_string_becomes_null_not_an_empty_column(constraint):
     await rulebooks_svc.update_rule(
         constraint["rule"], constraint["uid"], verify_with="", expires_when="",
     )
-    row = await _row(constraint["rule"])
+    row = await rule_row(constraint["rule"])
     assert row.verify_with is None
     assert row.expires_when is None
 
@@ -89,7 +84,7 @@ async def test_naming_a_field_in_clear_empties_it(constraint):
     await rulebooks_svc.update_rule(
         constraint["rule"], constraint["uid"], clear=["verify_with"],
     )
-    row = await _row(constraint["rule"])
+    row = await rule_row(constraint["rule"])
     assert row.verify_with is None
     # expires_when was NOT named, so it survives — clearing is per-field, and
     # a caller retiring one field must not lose the others.
@@ -107,7 +102,7 @@ async def test_rewording_the_check_drops_the_stamp(constraint):
         constraint["rule"], constraint["uid"],
         verify_with="read the runner's container shell, not the image's",
     )
-    row = await _row(constraint["rule"])
+    row = await rule_row(constraint["rule"])
     assert row.verified_at is None
 
 
@@ -115,7 +110,7 @@ async def test_clearing_the_check_drops_the_stamp(constraint):
     await rulebooks_svc.update_rule(
         constraint["rule"], constraint["uid"], clear=["verify_with"],
     )
-    row = await _row(constraint["rule"])
+    row = await rule_row(constraint["rule"])
     assert row.verified_at is None
 
 
@@ -132,7 +127,7 @@ async def test_editing_anything_else_leaves_the_stamp_alone(constraint):
             "applies to the build, not to `run:`.",
         expires_when="the runner grows a shell setting",
     )
-    row = await _row(constraint["rule"])
+    row = await rule_row(constraint["rule"])
     assert row.verified_at is not None
     assert row.why.startswith("act_runner picks the shell")
 
@@ -221,11 +216,11 @@ async def test_a_failed_check_writes_nothing(rulebook_of_three):
     not in a special condition — it is WRONG. Recording the failure would let
     it sit there being false with the sweep satisfied that someone looked.
     """
-    before = await _row(rulebook_of_three["stale"])
+    before = await rule_row(rulebook_of_three["stale"])
     await rulebooks_svc.mark_rule_verified(
         rulebook_of_three["stale"], rulebook_of_three["uid"], still_true=False,
     )
-    after = await _row(rulebook_of_three["stale"])
+    after = await rule_row(rulebook_of_three["stale"])
     assert after.verified_at == before.verified_at