[quality] Non-hermetic unit tests touch live /data state — proxy test deletes the production proxy CA

## Finding A full `go test ./...` on a hive host (any machine with live `/data` hive state) fails in three packages, and one test is actively destructive: 1. **`pkg/proxy`** — `TestNewGitHubProxy` (proxy_deep2_test.go) and `TestNewGitHubProxyWithWritableDir` (proxy_deep3_test.go) let `NewGitHubProxy` write the CA to the default `CACertPath` = `/data/proxy-ca.pem`, and the latter does `defer os.Remove(CACertPath)`. On a hive host with write access, running unit tests **overwrites and then deletes the production MITM proxy CA**, breaking TLS trust for every agent. `CACertPath`/`caKeyPath` are vars specifically so tests can redirect them (github_proxy.go:143-148), and sibling tests (github_proxy_coverage_test.go, proxy_coverage2_test.go) already do — these two just don't. 2. **`pkg/scheduler`** — `TestLoadPromptTemplate_FromPoliciesDir` builds its fixture under a temp dir but uses agent name `scanner`; `loadPromptTemplate` checks `/data/policies/examples/kubestellar/agents/scanner.md` *before* `cfg.Policies.LocalDir`, so the live deployed policy shadows the fixture and the test fails. 3. **`pkg/tokens`** — `TestCollector_Summary_Initially` expects a nil summary, but `NewCollector` unconditionally loads the snapshot at `/data/token-summary.json`, which exists on any live host. CI runners are fresh so these pass there, hiding the problem — but any developer or agent running the suite on a machine with hive state gets 3 failing packages, and the proxy run is destructive. ## Recommendation Make the three tests hermetic (test-only changes, no production code): - Redirect `CACertPath`/`caKeyPath` to `t.TempDir()` in both proxy tests, using the existing save/restore pattern; drop the `/data` mkdir/remove and the `os.Remove(CACertPath)`. - Use a unique agent name in the scheduler test so live `/data` policy paths cannot shadow the fixture. - Construct the tokens collector with a temp `persistPath` so 'no snapshot on disk' is actually true. A hold-gated PR with these fixes accompanies this issue. Longer term, consider a lint/CI guard rejecting hardcoded `/data` paths in `_test.go` files. ## Priority - Impact: high (destructive to live proxy CA; blocks local test runs) - Effort: low (test-only fixes, pattern already exists in-tree) --- *Filed by quality agent (hold-gated mode)* --- 🐝 **Hive Agent**: `quality` | **Instance:** `hosted-available-oke-11-placeholder-r05x` | **SHA:** `unknown` — hive: agent=quality backend=copilot model=claude-fable-5 copilot=1.0.78