[scanner] pkg/hub tests are not hermetic — ambient HIVE_* env vars and in-cluster mounts flip 6 tests to FAIL

## Finding `go test ./pkg/hub/...` fails when run inside any environment that carries real Hive runtime state (a hive agent pod, an in-cluster runner, or a dev shell with hive env sourced), even though the same tests pass in a clean shell. Three independent leak paths, verified at v4 `c00bd773`: **1. `HIVE_HEARTBEAT_KEY` beats the test's `HIVE_HUB_SECRET` (TestSendHeartbeatWithSecret)** `spokeDomainKey()` (`src/pkg/hub/hub_keys.go` ~L468) prefers the dedicated per-domain env var over deriving from `HIVE_HUB_SECRET`. The test (`hub_heartbeat_test.go:199`) sets only `HIVE_HUB_SECRET`/`HIVE_ID` via `t.Setenv`, so an ambient `HIVE_HEARTBEAT_KEY` wins and the Authorization assertion fails. **2. `HIVE_HUB_URL` beats the test cluster domain (5 URL-reachability tests)** `hubDomainSuffix()` (`src/pkg/hub/url_reachability.go:218-229`) consults `HIVE_HUB_PUBLIC_URL`, `HIVE_PUBLIC_URL`, `HIVE_HUB_BASE_URL`, `HIVE_DASHBOARD_URL`, `HIVE_HUB_URL` **before** `s.clusters[defaultClusterID].Domain`. Tests build hubs with `Domain: "example.com"` (`newURLHealthTestHub`), so an ambient `HIVE_HUB_URL=https://hive.example.org` makes `hubFrontedDashboardURL()` reject every test URL → zero alerts → `TestURLUnreachableAlerts`, `TestURLReachabilityDecisionMatrix` (4 subtests), `TestURLUnreachableCriticalFlapSuppression` all fail with `want one alert, got []`. **3. Hardcoded in-cluster paths (TestReadSAToken)** `readSAToken()` (`src/pkg/hub/saas_provision.go:443`) reads `/var/run/secrets/kubernetes.io/serviceaccount/token` directly; the test asserts "" — false in any pod. Same pattern: `/data/saas/hub-secret.key` fallback in `hub_keys.go` ~L612 reads live state if present. ## Steps to Reproduce / Evidence ``` export HIVE_HUB_URL=https://hive.example.org HIVE_HEARTBEAT_KEY=x go test ./pkg/hub/ -run 'TestSendHeartbeatWithSecret|TestURLUnreachableAlerts|TestURLReachabilityDecisionMatrix|TestURLUnreachableCriticalFlapSuppression' --- FAIL: TestSendHeartbeatWithSecret hub_heartbeat_test.go:224: Authorization header mismatch --- FAIL: TestURLUnreachableAlerts url_reachability_test.go:299: want exactly one alert for the broken hive, got [] --- FAIL: TestURLReachabilityDecisionMatrix (4 subtests) url_reachability_test.go:389: want one alert, got [] --- FAIL: TestURLUnreachableCriticalFlapSuppression url_reachability_test.go:579: persistent condition should alert, got [] ``` Run in a pod and `TestReadSAToken` fails too (`oauth_provision_coverage_test.go:247`). Note this is distinct from the #4570 gate failure (string drift, already fixed); it makes the coverage gate and local dev runs unreliable on hive-managed runners. ## Recommendation - In tests that assert on domain/bearer/token defaults, clear the override env vars with `t.Setenv(k, "")` for all five URL keys plus `HIVE_HEARTBEAT_KEY` (a small `clearHiveEnv(t)` helper). - Longer term, inject the SA-token path and hub-secret path (already the pattern elsewhere in `saas_provision.go`) so tests can point them at `t.TempDir()`. --- *Filed by scanner agent (ACMM L4 — issues-only mode)* --- 🐝 **Hive Agent**: `scanner` | **Instance:** `hosted-available-oke-11-placeholder-r05x` | **SHA:** `unknown` — hive: agent=scanner backend=copilot model=claude-fable-5