Just: pin what a root offers apart from what it runs

`--all-checks` enables the checks a justfile offers; a root can separately pass
checks unconditionally, which are not offers. Nothing distinguished the two, and
they are easy to conflate when reading a justfile.

The flag is injected on every language test run rather than typed, so it means
"enable whatever this root offers" and a root offering nothing enables nothing.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: redsun82

misc/just/README.md

@@ -158,7 +158,8 @@ Another point is how launching QL tests can be tweaked:
 - you can add the additional checks that CI does with `--all-checks` or the `+`
   abbreviation. These additional checks are configured in justfiles per language, and
   correspond to all the additional checks that CI adds (but that a dev might not want to
-  run by default).
+  run by default). Checks a root passes unconditionally are not offers: what it offers
+  is what `--all-checks` can enable
 
 Test arguments are passed around as `just` lists (`set lists`), so they reach the
 underlying runner already split and arguments containing spaces survive intact.

misc/just/test_codeql_test_run.py

@@ -146,6 +146,37 @@ def test_an_empty_argument_does_not_disturb_a_separator(self):
         self.assertNotIn("--", flags("", "--", "--check-databases"))
 
 
+class TestOfferedChecks(unittest.TestCase):
+    """What a root offers and what `--all-checks` enables are separate things.
+
+    These go through `main` because that is where the two meet. `--all-checks` is
+    injected on every language test run rather than typed, so it means "enable whatever
+    this root offers" and not "I want more coverage": a root offering nothing has to
+    stay runnable through it.
+    """
+
+    def test_an_offered_check_is_applied_when_asked_for(self):
+        applied = flags("--extra-check=--check-databases", "--all-checks")
+        self.assertIn("--check-databases", applied)
+
+    def test_an_offered_check_stays_held_back_until_it_is(self):
+        self.assertNotIn("--check-databases", flags("--extra-check=--check-databases"))
+
+    def test_asking_for_checks_a_root_offers_none_of_enables_nothing(self):
+        self.assertEqual(paths("--all-checks", "some/test"), ["some/test"])
+        self.assertEqual(flags("--all-checks", "some/test"), flags("some/test"))
+
+    def test_a_check_passed_unconditionally_is_not_an_offer(self):
+        # A root can mean to run a check always rather than put it behind the flag. That
+        # is a flag like any other here, so it neither becomes an offer nor is withheld
+        # until the offers are asked for.
+        always = flags("--check-databases", "some/test")
+        self.assertIn("--check-databases", always)
+        self.assertEqual(
+            flags("--check-databases", "--all-checks", "some/test"), always
+        )
+
+
 class TestSettings(unittest.TestCase):
     """`RAM_PER_THREAD` and `CPUS` are read back after assignments are applied.