test(infra): fix the 3 stale/flaky infra tests to the current contracts

- test_engine_image_and_rustfs_policy: root Dockerfile was refactored to the
  digest-pinned ousast-task-base (carries semantic+s3 deps) + a joern-build stage,
  installing the package --no-deps. Updated the stale `COPY benchmarks` (now
  --chown=1000) and `.[semantic,s3]` (now --no-deps + joern-cli copy + pinned base)
  assertions to the new contract.
- test_image_stages: plane/Dockerfile.engine-task refactored the same way; the
  split marker is now `FROM ${ENGINE_REF} AS replay`, base is ousast-task-base
  (not ax-task-runner:v0.3.1), and the replay stage no longer installs git (base
  provides it). Re-pinned the engine-stage SHA and updated the markers/assertions.
- test_partial_clone_lazy_fetch: passed alone but failed mid-suite — a leaked
  GIT_DIR/GIT_OBJECT_DIRECTORY/alternates from an earlier test changed the
  missing-blob count. Added an autouse fixture that neutralises inherited git
  control vars so every test in the file is self-contained (reproduced + verified).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/test_unseen_extract.py

@@ -16,6 +16,25 @@ e = importlib.import_module("benchmarks.unseen.extract")
 s = importlib.import_module("benchmarks.unseen.source")
 
 
+@pytest.fixture(autouse=True)
+def _hermetic_git_env(monkeypatch):
+    """Neutralise inherited Git control vars so each test is self-contained.
+
+    A GIT_DIR / GIT_OBJECT_DIRECTORY / alternates value leaked from an earlier test in the suite redirects
+    object lookup: the partial-clone lazy-fetch test then sees a different missing-blob count (it passes alone
+    but failed mid-suite). These tests build their own repos under tmp_path and must not read ambient git env.
+    """
+    for var in (
+        "GIT_DIR",
+        "GIT_WORK_TREE",
+        "GIT_INDEX_FILE",
+        "GIT_OBJECT_DIRECTORY",
+        "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+        "GIT_COMMON_DIR",
+    ):
+        monkeypatch.delenv(var, raising=False)
+
+
 @pytest.mark.parametrize("slow", [False, True])
 def test_process_deadline_restores_alarm(slow):
     original = signal.getsignal(signal.SIGALRM)