ci: pytest runs with the hunt and semantic extras kept; sandbox tests skip by cause where no bwrap exists

CI's first full pytest run since 2836b78 showed 65 failures in three classes. uv run re-synced the environment
to the lockfile's default extras before pytest, removing dspy again (UV_NO_SYNC=1 now). The learn slice, pair
corpus and hunt producer tests need tree-sitter (semantic extra installed). Thirty-two tests need bubblewrap
isolation, which CI's container cannot provide: they carry a sandbox marker and skip where the isolation
preflight fails, with the cause's type in the reason; proven locally by hiding bwrap (7 skipped, 23 passed).
The partial-clone extraction test now probes one lazy fetch through git itself first, so git's own stderr
reaches the next CI log instead of git_exit_128.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

tests/conftest.py

@@ -127,3 +127,23 @@ def plane_profile(tmp_path, monkeypatch: pytest.MonkeyPatch):
     for key in ("OUSAST_KUBE_CONTEXT", "OUSAST_MEMORY", "OUSAST_REGISTRY", "OUSAST_IMAGES", "OUSAST_EXEC"):
         monkeypatch.delenv(key, raising=False)
     return root / "test.toml"
+
+
+def pytest_collection_modifyitems(config: pytest.Config, items: list[pytest.Item]) -> None:
+    """Tests marked ``sandbox`` need bubblewrap isolation; where the preflight fails they skip, named by cause.
+
+    CI's container has no bwrap and no user namespaces, so these tests can only run on a host; a skip there is
+    an honest statement, a failure there says nothing about the code."""
+    marked = [item for item in items if item.get_closest_marker("sandbox")]
+    if not marked:
+        return
+    from openultrasast.search import _sandbox
+
+    try:
+        _sandbox.isolation_check(timeout_seconds=30)
+    except _sandbox.IsolationUnavailable as exc:
+        reason = f"sandbox isolation unavailable ({type(exc.__cause__ or exc).__name__})"
+    else:
+        return
+    for item in marked:
+        item.add_marker(pytest.mark.skip(reason=reason))