test(python): harden export cleanup and trust coverage

[codeforester]

Summary

• Add direct coverage for devcontainer settings, unsupported/ambiguous manifest classification, stable rendering, and overwrite refusal.
• Exercise cleanup fail-closed paths for unreadable metadata/directories, unsafe path components, descriptor failures, active runs, and unsafe-only previews.
• Cover trust resolution failures plus JSON-adjacent YAML, CSV, TSV, terminal, empty-workspace, manifest mismatch, and revoke-noop contracts.

Focused coverage improved from 58% to 99% for devcontainer export, 82% to 88% for cleanup, and 78% to 87% for trust.

Issue

Fixes #2050

Validation

• Focused target suite (77 passed, 38 subtests; three-module combined coverage 90%)
• Pylint on all touched test files
• Full Python coverage suite and ratchet (1,107 passed, 321 subtests; 90.03% statements, 80.03% branches, 87.57% combined)
• ./bin/base-test with supported sibling source overrides (1,107 Python tests, 321 subtests, and 899 BATS tests passed)

Demo Impact

None. Test-only hardening; no user-facing behavior changes.

Notes

The cleanup tests remain isolated under temporary cache roots and assert fail-closed behavior; they do not perform deletion outside those fixtures. Documentation and AI context are not applicable because production behavior is unchanged.

Checklist

• Branch name follows <category>/<issue>-<YYYYMMDD>-<slug>, and the prefix matches the issue's single standard category label.
• PR is scoped to one issue, unless a documented multi-issue exception applies.
• PR body explains what changed and how it was validated.
• Validation commands were run from the current checkout or worktree, or unavailable checks are explained.
• Relevant BATS and Python tests pass.
• Bug fixes include regression proof or a documented reproduction when practical.
• Documentation is updated when behavior or user-facing commands change.
• AI context is updated in .ai-context/, or the PR body explains why it is not applicable.
• PR includes Fixes #<issue> or Closes #<issue> when it should close the issue.
• Demo Impact is meaningful for needs-demo work, or explicitly says None.