Add CI guard against pytest-local.ini drift and document its use for agents

[mborodii-prog]

Close the coverage gap in the local/offline test config and guard it against drift

Closes #

Description

When developing locally, it would be ideal to have a smaller set of tests that do not require live KC tokens. Currently, Codex gets hung up running tests that require live access.

Desired Behavior

Streamlined smoke test set that allows local AI to test it's changes

Example current / desired from codex:

The apparent PY failures were not contract regressions—they were existing live-service recipe tests pulled in by a broad name filter, and the sandbox correctly could not contact Wrangles SSO. I'm narrowing the run to the changed offline contract paths, then I'll separate that evidence from any live-service coverage in the handoff.

What was actually wrong

The credential-free selection this issue asks for already existed (pytest-local.ini + scripts/test-local.ps1), and running it does solve the problem: 1566 passed, 0 credential-related failures, only two known timing-sensitive tests flaky under load. So the capability wasn't missing.
Two real gaps were:

1. Coverage drift. Several tests/**/test_*.py files existed on disk but were reachable by neither testpaths nor an explicit --ignore, so they were silently skipped by every local run with no signal that anything was missing: test_akeneo.py, test_http.py, test_s3.py, test_train.py, test_sftp.py, top-level test_wrangles.py, and the mixed test_back_ processes.py`.
2. Nobody told Codex the offline config exists. AGENTS.md — the file Codex reads automatically every session — said nothing about testing at all. A fresh agent had no way to discover pytest-local.ini and would default to bare pytest, hitting exactly the live-SSO failures quoted above.

Changes

pytest-local.ini

Classified every previously-uncovered file:

• Added to testpaths (offline-safe): test_akeneo.py (self-skips via its existing _skip_no_creds marker when no credentials are set), test_sftp.py (no tests to run yet).
• Added to --ignore (needs live credentials/services, no mocking): test_http.py (real HTTP + OAuth against sso.wrangle.works), test_s3.py (real AWS), test_train.py (real model training/classify calls), top-level test_wrangles.py (real classify/extract calls).
• test_back_ processes.py (mixed file) added to testpaths, with its 3 credential-dependent tests individually --deselected
  (test_user_config_credentials, test_refresh_token_error, test_refresh_token`), keeping its 2 offline-safe mocked auth tests running.
• Fixed a real bug found while doing this: pytest's testpaths option, like addopts, is shlex-split. The unquoted tests/test_back_ processes.py entry was silently splitting into two nonexistent paths (tests/test_back_ and processes.py), so that file wasn't actually being collected at all despite looking correct in the raw ini. Fixed by quoting it.

scripts/check_pytest_local_config.py (new)

Validates pytest-local.ini against a full, unrestricted test collection:

• Every testpaths entry resolves to a real path on disk (catches the shlex-splitting bug above, and any future instance of it).
• Every --ignore=/--deselect= entry still matches a real, currently collected test (catches stale entries left by a rename/delete).
• Every tests/**/test_*.py file is covered by testpaths or explicitly--ignored (catches a newly added file being silently excluded).

Verified it passes clean against the current config, and correctly fails with clear message when a stale ignore, stale deselect, uncovered new file, or unquoted-space testpaths entry is injected.

.github/workflows/ci.yml

New pytest-local-config job runs the check above on every push/PR, so a forgotten update to pytest-local.ini fails CI instead of rotting silently.

AGENTS.md

New "Running tests locally" section instructing agents to use pytest -c pytest-local.ini / scripts/test-local.ps1 instead of bare
pytest, explaining why (live SSO/AWS/AI credentials aren't available in sandbox), how to report a live-service-only failure honestly instead of as a regression, and how to fix pytest-local.ini themselves via the new drift-check when they add a test file.

Tests

• Full local suite via scripts/test-local.ps1 against the corrected config: 1566 passed, 9 skipped, 2 failed (test_timeout_time,
  TestBatch::test_batch_threads — both timing-sensitive; reproduced in isolation immediately after and both passed in 8.37s, confirming system-load flakiness, not a regression from this change).
• scripts/check_pytest_local_config.py run directly: passes clean.
• Manually verified the drift-check catches each failure mode it's meant to: a stale --ignore, a stale --deselect, a new uncovered test file, and an unquoted-space testpaths entry.