test(auth): isolate suite from local .env so ANTHROPIC_API_KEY can't leak

[silversurfer562]

Problem

tests/test_auth_routing.py::TestCliAuthStatus::test_status_warns_when_api_mode_without_key passed in CI but failed locally.

Root cause: the conftest already delenv's ANTHROPIC_API_KEY for every test to keep the suite off the real Anthropic API. But cli.main() calls dotenv.load_dotenv() at startup, and a dev checkout's repo-root .env symlink (attune-author/.env → the sibling attune-ai/.env, which holds a real key) re-injects the key right after the delenv. So auth status saw a key and skipped the expected WARNING line. CI has no .env, so it stayed green — a machine-dependent flake.

Fix

Co-locate a dotenv.load_dotenv no-op with the delenv it completes, in conftest's _lenient_polish_by_default autouse fixture. The delenv was only half the guarantee; this closes the hole at the same altitude so the two can't drift apart.

• Production code untouched — load_dotenv still runs normally for real CLI users.
• Escape hatch documented — a test that wants real dotenv loading restores it via its own monkeypatch.setattr.

Verification

Reproduced by creating the .env symlink in the worktree, then:

• Original failure confirmed (the WARNING assertion failed exactly as reported) with the guard disabled.
• With the fix: test_auth_routing.py → 32 passed.
• Full suite with .env present → 1086 passed, 31 skipped.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!