test(host): serialize Central-boot fixtures to close env-var race

CentralDbTestEnvironment sets five process-wide environment variables, and
Program's AddEnvironmentVariables() reads them at an unpredictable point during
host boot. With xUnit collection parallelization on, one fixture's teardown
could clear a var mid-boot for a sibling. Since the secrets adoption (G-4)
three of those keys are ${secret:...} references that fail closed, turning a
previously benign empty value into a SecretNotFoundException that aborts the
boot — an intermittent CI failure.

Adds a HostBootCollection that serializes every fixture booting a real host
while depending on that shared state, folding in the narrower "ActorSystem"
collection so its members stay serialized with each other as before. Site-role
fixtures stay parallel: they call Configuration.Sources.Clear(), dropping the
env-var provider, so they cannot participate in the race.

CentralDbTestEnvironment now also fails fast if two instances are ever live at
once, making a regression (a fixture added outside the collection) deterministic
rather than intermittent — this is what surfaced the disposed-CTS defect fixed
in the previous commit. Fixture teardown is try/finally so a throwing host
teardown can no longer strand the vars for the rest of the run.

Cost: Host.Tests runs ~2m30s -> ~4m10s; the serialized Central-boot classes are
most of the assembly's parallelism.

Fixes: Gitea #15

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/ActorPathTests.cs

@@ -10,14 +10,11 @@ using ZB.MOM.WW.ScadaBridge.Host.Actors;
 
 namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
 
-[CollectionDefinition("ActorSystem")]
-public class ActorSystemCollection : ICollectionFixture<object> { }
-
 /// <summary>
 /// Verifies that all expected Central-role actors are created at the correct paths
 /// when AkkaHostedService starts.
 /// </summary>
-[Collection("ActorSystem")]
+[Collection(HostBootCollection.Name)]
 public class CentralActorPathTests : IAsyncLifetime
 {
     private WebApplicationFactory<Program>? _factory;
@@ -93,9 +90,20 @@ public class CentralActorPathTests : IAsyncLifetime
 
     public async Task DisposeAsync()
     {
-        _factory?.Dispose();
+        // try/finally: a throwing host teardown must not strand the process-wide
-        Environment.SetEnvironmentVariable("DOTNET_ENVIRONMENT", _previousEnv);
+        // environment variables. Without it, one failed _factory.Dispose() leaks
-        _dbEnv?.Dispose();
+        // DOTNET_ENVIRONMENT=Central and the CentralDbTestEnvironment vars into
+        // every later test in the run.
+        try
+        {
+            _factory?.Dispose();
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("DOTNET_ENVIRONMENT", _previousEnv);
+            _dbEnv?.Dispose();
+        }
+
         await Task.CompletedTask;
     }
 
@@ -149,7 +157,7 @@ public class CentralActorPathTests : IAsyncLifetime
 /// Verifies that all expected Site-role actors are created at the correct paths
 /// when AkkaHostedService starts.
 /// </summary>
-[Collection("ActorSystem")]
+[Collection(HostBootCollection.Name)]
 public class SiteActorPathTests : IAsyncLifetime
 {
     private IHost? _host;

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/AkkaHostedServiceAuditWiringTests.cs

@@ -86,6 +86,7 @@ public class AkkaHostedServiceAuditWiringHoconTests
 /// <summary>
 /// Verifies Audit Log (#23) services land in the Central composition root.
 /// </summary>
+[Collection(HostBootCollection.Name)]
 public class CentralAuditWiringTests : IDisposable
 {
     private readonly WebApplicationFactory<Program> _factory;
@@ -156,9 +157,17 @@ public class CentralAuditWiringTests : IDisposable
 
     public void Dispose()
     {
-        _factory.Dispose();
+        // try/finally: a throwing host teardown must not strand the process-wide
-        Environment.SetEnvironmentVariable("DOTNET_ENVIRONMENT", _previousEnv);
+        // environment variables for the rest of the run.
-        _dbEnv.Dispose();
+        try
+        {
+            _factory.Dispose();
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("DOTNET_ENVIRONMENT", _previousEnv);
+            _dbEnv.Dispose();
+        }
     }
 
     [Fact]

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/CentralDbTestEnvironment.cs

@@ -26,6 +26,14 @@ namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
 /// the tokens entirely — so tests that boot the real <c>Program</c> pipeline do
 /// not need a seeded secrets store. All vars are restored on Dispose so tests
 /// stay isolated.
+///
+/// Every var below is <b>process-wide</b>, and the reader — <c>Program</c>'s
+/// <c>AddEnvironmentVariables()</c> — runs at an unpredictable point during host boot.
+/// Two live instances therefore cannot be allowed to overlap: one's Dispose would
+/// restore/clear a var while the other's boot is still reading it, and the fail-closed
+/// secrets expander turns that into a <c>SecretNotFoundException</c>. Serialization via
+/// <see cref="HostBootCollection"/> is what enforces the invariant; the overlap check in
+/// the constructor makes a regression fail deterministically instead of intermittently.
 /// </summary>
 internal sealed class CentralDbTestEnvironment : IDisposable
 {
@@ -64,8 +72,25 @@ internal sealed class CentralDbTestEnvironment : IDisposable
     private readonly string? _previousLdapPassword;
     private readonly string? _previousJwtSigningKey;
 
+    /// <summary>
+    /// Number of live instances. Only ever 0 or 1 while every consuming fixture is a
+    /// member of <see cref="HostBootCollection"/>; see the overlap check below.
+    /// </summary>
+    private static int _liveCount;
+
     public CentralDbTestEnvironment()
     {
+        if (Interlocked.Increment(ref _liveCount) != 1)
+        {
+            Interlocked.Decrement(ref _liveCount);
+            throw new InvalidOperationException(
+                $"Two {nameof(CentralDbTestEnvironment)} instances are live at once, so one fixture's " +
+                "teardown can clear the process-wide environment variables another fixture's host boot " +
+                $"is reading. Add the offending test class to the \"{HostBootCollection.Name}\" collection " +
+                $"([Collection({nameof(HostBootCollection)}.Name)]) so xUnit runs it sequentially with the " +
+                "other host-boot fixtures.");
+        }
+
         _previousConfig = Environment.GetEnvironmentVariable(ConfigKey);
         Environment.SetEnvironmentVariable(ConfigKey, ConfigurationDb);
 
@@ -89,5 +114,7 @@ internal sealed class CentralDbTestEnvironment : IDisposable
         Environment.SetEnvironmentVariable(PepperKey, _previousPepper);
         Environment.SetEnvironmentVariable(LdapPasswordKey, _previousLdapPassword);
         Environment.SetEnvironmentVariable(JwtSigningKeyKey, _previousJwtSigningKey);
+
+        Interlocked.Decrement(ref _liveCount);
     }
 }

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/CompositionRootTests.cs

@@ -80,6 +80,7 @@ internal static class AkkaHostedServiceRemover
 /// Verifies every expected DI service resolves from the Central composition root.
 /// Uses WebApplicationFactory to exercise the real Program.cs pipeline.
 /// </summary>
+[Collection(HostBootCollection.Name)]
 public class CentralCompositionRootTests : IDisposable
 {
     private readonly WebApplicationFactory<Program> _factory;
@@ -159,9 +160,17 @@ public class CentralCompositionRootTests : IDisposable
 
     public void Dispose()
     {
-        _factory.Dispose();
+        // try/finally: a throwing host teardown must not strand the process-wide
-        Environment.SetEnvironmentVariable("DOTNET_ENVIRONMENT", _previousEnv);
+        // environment variables for the rest of the run.
-        _dbEnv.Dispose();
+        try
+        {
+            _factory.Dispose();
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("DOTNET_ENVIRONMENT", _previousEnv);
+            _dbEnv.Dispose();
+        }
     }
 
     // --- Singletons ---

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/HealthCheckTests.cs

@@ -17,6 +17,7 @@ namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
 /// active-node) rather than by check-name predicates. These are pure route/tag assertions
 /// — they require no database, LDAP, or formed Akka cluster.
 /// </summary>
+[Collection(HostBootCollection.Name)]
 public class HealthCheckTests : IDisposable
 {
     private readonly List<IDisposable> _disposables = new();

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/HostBootCollection.cs

@@ -0,0 +1,25 @@
+namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
+
+/// <summary>
+/// Serializes every fixture that boots a real host while depending on process-wide
+/// state — the <c>DOTNET_ENVIRONMENT</c> role selector and the environment variables
+/// <see cref="CentralDbTestEnvironment"/> sets.
+///
+/// <c>Program</c>'s configuration builder calls <c>AddEnvironmentVariables()</c> at an
+/// unpredictable point during boot, so a sibling fixture's teardown (which restores or
+/// clears those vars) can otherwise be observed mid-boot as a transient null. Since the
+/// secrets adoption (G-4) three of those keys are <c>${secret:...}</c> references that
+/// fail closed, which turns that race into a hard <c>SecretNotFoundException</c>.
+/// xUnit runs classes in a shared collection sequentially, which removes the overlap.
+///
+/// Site-role fixtures are deliberately not members: they call
+/// <c>Configuration.Sources.Clear()</c>, dropping the environment-variable provider, so
+/// they neither read nor write the shared state and stay free to run in parallel.
+///
+/// Supersedes the narrower "ActorSystem" collection, whose members are folded in here.
+/// </summary>
+[CollectionDefinition(HostBootCollection.Name)]
+public class HostBootCollection
+{
+    public const string Name = "HostBoot";
+}

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/HostStartupTests.cs

@@ -9,6 +9,7 @@ using ZB.MOM.WW.ScadaBridge.Host;
 
 namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
 
+[Collection(HostBootCollection.Name)]
 public class HostStartupTests : IDisposable
 {
     private readonly List<IDisposable> _disposables = new();

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/MetricsEndpointTests.cs

@@ -13,6 +13,7 @@ namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
 /// cluster state. This is a pure route assertion — it requires no database, LDAP, or formed
 /// Akka cluster. The Central-role factory bootstrap mirrors <see cref="HealthCheckTests"/>.
 /// </summary>
+[Collection(HostBootCollection.Name)]
 public class MetricsEndpointTests : IDisposable
 {
     private readonly List<IDisposable> _disposables = new();