test: close gaps found in the post-merge reviews of #797, #803 and #804

[soustruh]

What was wrong

Reviews of three merged PRs found tests that pass although the behavior that they guard is broken.

• test: make false-passing negative controls fail on regression (#790) #797: the check_error_codes.py tests call only the scanner. No test calls main(), which make check-error-codes and CI run. A main() that scans no files or never returns 1 passes all tests.
• fix(data-app): page through GET /apps so list finds apps beyond the first page (#798) #803: no test checks the page-cap warning, an error on a later page of GET /apps, or the sync pull type lookup through a paged response. The list_apps docstring says that the endpoint has no branchId parameter, but sandboxes-service accepts componentId, type and branchId.
• test: add ratcheting API call-count tests for hot commands (#802) #804:
  • The fixtures have only the fields that the code reads. A per-item call that runs only for a transformation, a job with runId or an alias table passes.
  • The two-project tests cannot show which project a call was for. Two calls for one project and none for the other pass.
  • The tests do not check the result. project status passes when each project has status: "error", and a list command exits 0 when a project call fails.
  • config list and storage tables do not compare the query, so a change to include passes. job list compares the raw query, so a different parameter order fails.
  • The counts are exact only on an editable install. An installed wheel adds the auto-update call to GitHub.
  • CONTRIBUTING.md says that the 1-vs-10 case proves that the count does not grow per item.

What changed

• tests/test_integration.py: new tests run main() with a planted literal and with a doc that has no row for one enum member, and check that SRC_ROOT is the source tree. The module docstring says which tests need credentials.
• tests/test_permissions_cli.py: the permissions set refusal test also checks the refusal text.
• tests/test_data_app_service.py: new tests for the page-cap warning, a 503 on page 2 after the retries, and load_data_app_types with the data app on page 2.
• data_science_client.py: the list_apps docstring names the filters of the endpoint and says that the method sends none of them. The request does not change.
• tests/helpers.py: assert_api_calls compares the query parsed and sorted. include_token=True adds the X-StorageApi-Token of each call.
• tests/test_api_call_counts.py:
  • The component fixture has an extractor, a transformation with a row and storage mappings, and a writer. Jobs have runId, result and endTime. Tables are plain, alias and shared. No expected call list changed.
  • The two-project tests expect one call for each token.
  • project status checks status == "ok", and list commands check that errors is empty.
  • config list and storage tables pin the query.
  • An autouse fixture sets KBAGENT_AUTO_UPDATE=false. The module docstring says that the telemetry event is not counted, because the tests call app and not run().
• CONTRIBUTING.md: the call-count bullet says what the 1-vs-10 case catches and what it does not catch, and that fixtures must look like real API payloads.

Not changed

The stop rule of list_apps stays. It stops on a page shorter than limit=500, and sandboxes-service has accepted a limit of up to 500 since its first commit.

Tests

• Each new check fails on a change to the code that it guards. Examples: if False: in place of if found_any: in main(), list_apps with one request, a per-config call only for transformations, a per-job call only for jobs with runId, both fan-out calls with one token, include=configuration,rows.
• A different parameter order in job list still passes.
• make check passes. ty reports only the existing hatchling import warning in scripts/hatch_build.py.

Tests and one docstring only. No version bump, no changelog entry.

[keboola-pr-reviewer-bot]

Verdict: auto_approve (risk 1/5) · profile _default

Test-only PR plus one inert docstring edit — safe to auto-approve.