fix: stop environment leakage in build identity and the unit suite

[n0nuser]

Closes #177 — two independent pre-existing bugs, both reproduced on clean main at fbe663b. Neither was caused by #175/#176.

1. task docker-check could never pass

Taskfile.yml:130 used LOCALRAG_BUILD_SHA="$$(git rev-parse HEAD)". The $$ is not consumed as Task escaping — the shell expands it to its own PID, so the image was stamped 99848(git rev-parse HEAD) and the comparison against git rev-parse HEAD always failed. The "rebuild before trusting an end-to-end result" guarantee in AGENTS.md was unenforceable.

The SHA is now resolved by Task itself, as a task-level sh: var. A CI step in the Taskfile smoke job asserts the resolved docker-up command carries the current SHA, so a silent regression fails loudly.

2. The unit suite read the developer's local .env

Env vars and .env outrank YAML (ADR 020) — correct for the app, wrong for tests asserting YAML-layer defaults. With a .env containing API_KEY and a timeout override: 25 failures. Without it: 0.

tests/conftest.py gains an autouse fixture that pins env_file to None and clears the documented flat names (FLAT_TO_PATH + UNGROUPED_FIELDS) for non-integration tests. Integration tests are exempt — they configure themselves from the real environment to reach the running stack. LOG_LEVEL=ERROR is re-asserted to keep runs quiet; no test asserts on it. monkeypatch.setenv inside a test body still wins, since the fixture runs first.

test_configuration_precedence_is_defaults_yaml_dotenv_environment_cli exercises the .env layer deliberately, so it opts back in; its chdir makes tmp_path's .env the only reachable one.

Verification

Condition	Result
Hostile .env (API_KEY, LLM_TIMEOUT_SECONDS=120)	480 passed (was 25 failed / 455 passed)
Hostile exported vars (API_KEY, RAG_TOP_K=42, two timeouts)	480 passed
No .env, clean env (the CI condition)	480 passed
task --dry docker-up	stamps fbe663b910f2f…, matching git rev-parse HEAD
docker compose build localrag-api → docker run … echo $LOCALRAG_BUILD_SHA	returns the real SHA

Ran with Task 3.52.0. The full stack was not started end-to-end (it pulls multi-GB images and models); the chain the bug breaks — Task var → compose build arg → Dockerfile ARG/ENV → image — was verified directly, and /build-info reading os.environ is already covered by tests/test_api.py:161.

Not addressed here

#177 also notes the repo's own .env is not shell-safe (set -a && . ./.env fails on the unquoted RAG_SYSTEM_PROMPT line) and lists API_KEY twice. That file is untracked and local to the maintainer's machine, so it is out of scope for this branch — worth a follow-up on .env.example if the same shape is documented there.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UZ7AySD1EFME3xjMiQNp1p