Limit source cleanup assertions to the helper temporary checkout #5221

🤖 Generated by the Agentic Engineer

Description

The source-checkout cleanup regression reports a leaked checkout during macOS sandbox validation even when the disposable checkout has been removed. This gives maintainers and agents a false failure when validating otherwise unrelated changes. No hosted CI or production failure is established by this observation.

Steps to Reproduce

At Platform commit 9952428d8f0036444df73ff0c8075380c017180c, run:

go test -count=1 -timeout=30s -run '^TestResolveFoldInputsRemovesItsCheckout$' -v ./scripts/reconcile-talos-kernel-args

The unchanged test fails repeatedly inside the macOS Codex sandbox and passes outside that sandbox at the same revision. The complete package suite also passes on the host.

Expected Behavior

The test proves that every temporary source checkout owned by the helper is removed after successful and failed source reads. Real checkout leaks and cleanup errors remain failures. An unrelated tool cache must not be misclassified as a source checkout.

Actual Behavior

The assertion at main_test.go:699 requires the entire fixture TMPDIR to be empty. A private Go test overlay changed only the failure diagnostic to print directory entries; the sole remaining entry was the regular file xcrun_db, with no ksail-fold-inputs-* checkout present. The source identities had already passed the test's successful-read assertions. Why this cache appears only in the sandbox has not been established.

Environment

macOS arm64; the repository test source is unchanged. This was discovered while auditing the dependency update in #5220 and is independent of its audited-input data.

Acceptance Criteria

• Reproduce the parent-directory pollution without depending on a particular host or sandbox.
• Scope cleanup proof to the helper's owned source checkouts, preserving successful-read and failed-read cleanup checks.
• A deliberately retained owned checkout still fails the test; an unrelated regular tool-cache file does not.
• Preserve the injected cleanup-error control and fail-closed source-identity behavior.
• Pass the complete package suite in both the macOS sandbox and the host environment, then verify required CI.

Additional Context

Part of #4979. Size: Small. This is validation reliability work, with no urgent production impact demonstrated; retain it in Backlog for refinement. Full local diagnostics are kept privately.