test(FN-4912): complete Step 9 — add env materialization verification coverage

Fusion-Task-Id: FN-4912
Fusion-Task-Lineage: 943d0651-052a-41b5-8069-4c60f4db1ba7

packages/engine/src/__tests__/reliability-interactions/secrets-env-materialization.test.ts

@@ -0,0 +1,56 @@
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { writeSecretsEnvFile } from "../../secrets-env-writer.js";
+import { reapOrphanWorktrees } from "../../worktree-pool.js";
+
+const dirs: string[] = [];
+function tmpRepo(): string {
+  const root = mkdtempSync(join(tmpdir(), "secrets-rel-"));
+  dirs.push(root);
+  execFileSync("git", ["init"], { cwd: root });
+  return root;
+}
+
+afterEach(async () => {
+  await Promise.all(dirs.splice(0).map((d) => rm(d, { recursive: true, force: true })));
+});
+
+describe("reliability interactions: secrets env materialization", () => {
+  it("writer refuses non-ignored env path", async () => {
+    const root = tmpRepo();
+    const worktree = join(root, ".worktrees", "a");
+    mkdirSync(worktree, { recursive: true });
+    execFileSync("git", ["init"], { cwd: worktree });
+
+    const audit = { filesystem: vi.fn() };
+    const result = await writeSecretsEnvFile({
+      rootDir: root,
+      worktreePath: worktree,
+      taskId: "FN-1",
+      settings: { secretsEnv: { enabled: true, filename: ".env", requireGitignored: true } },
+      worktreeSource: "fresh",
+      audit,
+      secretsStore: { listEnvExportable: vi.fn().mockResolvedValue([{ id: "1", key: "A", exportKey: "ALPHA", scope: "project", plaintextValue: "v" }]) } as any,
+    });
+
+    expect(result.reason).toBe("not-gitignored");
+    expect(audit.filesystem).toHaveBeenCalledWith(expect.objectContaining({ type: "secret:env-write-skipped" }));
+  });
+
+  it("orphan reap reclaims orphaned env artifacts", async () => {
+    const root = tmpRepo();
+    const worktreesDir = join(root, ".worktrees");
+    const orphan = join(worktreesDir, "ghost");
+    mkdirSync(orphan, { recursive: true });
+    writeFileSync(join(orphan, ".env"), "A=1\n");
+    writeFileSync(join(orphan, ".fusion-secrets-env.fingerprint"), "abc\n.env\n");
+
+    const removed = await reapOrphanWorktrees(root);
+    expect(removed).toBe(1);
+    expect(existsSync(orphan)).toBe(false);
+  });
+});