test(infra): fix the 3 stale/flaky infra tests to the current contracts

- test_engine_image_and_rustfs_policy: root Dockerfile was refactored to the
  digest-pinned ousast-task-base (carries semantic+s3 deps) + a joern-build stage,
  installing the package --no-deps. Updated the stale `COPY benchmarks` (now
  --chown=1000) and `.[semantic,s3]` (now --no-deps + joern-cli copy + pinned base)
  assertions to the new contract.
- test_image_stages: plane/Dockerfile.engine-task refactored the same way; the
  split marker is now `FROM ${ENGINE_REF} AS replay`, base is ousast-task-base
  (not ax-task-runner:v0.3.1), and the replay stage no longer installs git (base
  provides it). Re-pinned the engine-stage SHA and updated the markers/assertions.
- test_partial_clone_lazy_fetch: passed alone but failed mid-suite — a leaked
  GIT_DIR/GIT_OBJECT_DIRECTORY/alternates from an earlier test changed the
  missing-blob count. Added an autouse fixture that neutralises inherited git
  control vars so every test in the file is self-contained (reproduced + verified).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/test_engine_queue.py

@@ -199,8 +199,12 @@ def test_engine_k8s_render_contract():
 
 def test_engine_image_and_rustfs_policy():
     dockerfile = (ROOT / "Dockerfile").read_text()
-    assert "COPY benchmarks ./benchmarks" in dockerfile
-    assert ".[semantic,s3]" in dockerfile
+    assert "COPY --chown=1000 benchmarks ./benchmarks" in dockerfile
+    # The image is built on the digest-pinned task base (which carries the semantic+s3 deps), so the package
+    # installs --no-deps and Joern (the semantic engine) is copied from the joern-build stage.
+    assert "ousast-task-base:${TASK_BASE_TAG}@${TASK_BASE_DIGEST}" in dockerfile
+    assert "/venv/bin/pip install --no-deps --no-cache-dir ." in dockerfile
+    assert "COPY --from=joern-build /opt/joern-cli /opt/joern-cli" in dockerfile
     for name in ["engine_trace_worker.py", "engine_trace_parse.py", "engine_worker_service.py"]:
         assert (ROOT / "benchmarks/learn" / name).stat().st_size > 0
     doc = (ROOT / "docs/rustfs.md").read_text().split("## Scoped account for engine workers")[1]