[quality] Test hermeticity: scheduler, dashboard, and contributor-agent suites fail on hosts with live hive state

## Finding Three test suites read live host state instead of their fixtures, so they fail on any machine that has a running hive (agent hosts, dev boxes with `/data` populated, or a real `codex` on PATH). Reproduced on a clean clone of `v4` at `18e8172b` — none of this is caused by open PRs #4578/#4589. 1. **`pkg/scheduler` — `TestLoadPromptTemplate_FromPoliciesDir`**: `loadPromptTemplate` probes the hardcoded `/data/policies/examples/kubestellar/agents/.md` *before* the configured `Policies.LocalDir` (`src/pkg/scheduler/scheduler.go:127-137`). On a live-hive host the real scanner policy wins over the `t.TempDir()` fixture and the test fails with the full production template. 2. **`pkg/dashboard` — 13 failures on a live-hive host**: `TestCovG_HandleSSO`, `TestCovDF_SSO_*` (4), `TestCovD_DiscoverModelsNoCreds`, `TestQueryCLIModels_CopilotFallbackNoToken`, `TestCooldownCounts_ReflectsHubState`, `TestContributeFleet_IncludesCooldownCounts`, `TestIntegration_SelectTask_PromotionRequiresPR`, `TestCovK2_LiteLLMKeyStore`, `TestSSOHandoff_*` (2). These pick up real `/data` file I/O, HIVE_* env vars, or installed CLI credentials. 3. **`bin/contributor-agent.test.sh`** — the "missing codex binary" check runs under `env -i PATH="$PATH"`, so a real `codex` on PATH turns the expected `NOT_INSTALLED` into `NOT_AUTHED` and the suite aborts. CI is green only because runners happen to be clean; anyone validating locally on hive infrastructure gets false failures, which trains people to ignore red suites. ## Recommendation - Make the `/data/policies` probe path overridable (a package var already exists for `userSavedPolicyDir`; extend the same treatment to the probe list in `loadPromptTemplate`/`loadKickTemplate`) and point it at `t.TempDir()` in tests. - Audit the failing dashboard tests for hardcoded `/data` paths and ambient HIVE_*/CLI-credential reads; inject them via config or env set inside the test. - In `contributor-agent.test.sh`, build a scrubbed PATH (fake-bin dir + coreutils only) for the NOT_INSTALLED case instead of inheriting the host PATH. ## Priority - Impact: medium (false red on live hosts, masks real regressions) - Effort: medium --- *Filed by quality agent (hold-gated mode)* --- 🐝 **Hive Agent**: `quality` | **Instance:** `hosted-available-oke-11-placeholder-r05x` | **SHA:** `unknown` — hive: agent=quality backend=copilot model=claude-fable-5 copilot=1.0.78