Test drift: 4 pre-existing unit test failures on main (config validators + embedding fingerprint + provider default)

[meiiie]

Surfaced during Runtime Migration Epic #207 Phase 0 PR #209 CI run. All 4 tests fail on main without Phase 0 changes (verified by checking out main + re-running).

Failures

1. tests/unit/test_sprint30_semantic_memory_repo.py::TestSaveMemory::test_successful_save

   • Expected: embedding_space_fingerprint == "google:models/gemini-embedding-001:768"
   • Got: "openai:text-embedding-3-small:768"
   • Root cause: env-dependent — embedding fingerprint reflects whichever provider is configured first; test pins to google but env has openai default.

2. tests/unit/test_sprint160b_hardening.py::TestConfigSecurity::test_session_secret_rejected_in_production

   • Expected: ValueError matching session_secret_key
   • Got: Value error, SECURITY: enable_dev_login=True is forbidden in production
   • Root cause: validator order changed — enable_dev_login validator now fires first, swallowing the session_secret_key validator path.

3. tests/unit/test_config_validators.py::TestEnvironmentValidator::test_production

   • Same validator-order pattern as docs: update documentation for Gemini 2.5 Flash fix and v2.8 release #2.

4. tests/unit/test_sprint33_config_validators.py::TestLLMProvider::test_default_valid

   • Expected: default_provider == 'zhipu'
   • Got: 'nvidia'
   • Root cause: NVIDIA + DeepSeek went live recently and shifted the default; test expectation is stale.

Why these slipped through

PR #208 (last main merge) had a green Backend Unit Gate. Between #208 and #209 nothing else landed on main. The most likely explanation is that these tests are env-dependent and the CI runner environment has shifted (or local is now closer to CI than before).

Scope (small, separate from Phase 0–7)

Roughly 4 small fixes:

• Update test Feature/semantic memory v0.3 #1 expected value, OR force the embedding env var inside the test
• Update test docs: update documentation for Gemini 2.5 Flash fix and v2.8 release #2/Dev #3 to assert on the validator chain that actually fires in 2026
• Update test Codex/runtime lifecycle checkpoint 20260405 #4 to track the live default (nvidia) or pin via monkeypatch.setattr(settings, "llm_provider", "zhipu")

Suggest: 1 small chore(tests): heal config-validator + provider drift PR, branch codex/heal-test-drift. Not on Runtime Migration epic critical path.