test(docker): the plugin registers prune_docker as an admin write tool

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/plugins/docker/test_mcp_tools.py

@@ -8,6 +8,7 @@ import pytest
 
 import plugins.docker as docker_plugin
 from plugins.docker import mcp_tools as t
+from steward.models.users import UserRole
 
 NOW = datetime(2026, 10, 6, 12, 0, tzinfo=timezone.utc)
 
@@ -75,11 +76,14 @@ def test_service_findings_by_state():
 def test_plugin_exposes_the_mcp_hooks():
     reg = MagicMock()
     docker_plugin.register_mcp_tools(reg)
-    names = {call.args[0].__name__ for call in reg.call_args_list}
-    assert names == {"list_containers", "get_container", "list_swarm_services",
-                     "search_container_logs", "get_docker_disk_usage"}
-    for call in reg.call_args_list:
-        assert call.kwargs["read_only"] is True
+    regs = {call.args[0].__name__: call.kwargs for call in reg.call_args_list}
+    assert set(regs) == {"list_containers", "get_container", "list_swarm_services",
+                         "search_container_logs", "get_docker_disk_usage", "prune_docker"}
+    for name, kw in regs.items():
+        if name == "prune_docker":
+            assert (kw["role"], kw["read_only"]) == (UserRole.admin, False)
+        else:
+            assert (kw["role"], kw["read_only"]) == (UserRole.viewer, True), name
     assert callable(docker_plugin.mcp_overview)