test(orphans): the destructive sweep test is opt-in

CI mounts /var/run/docker.sock into the test container and the runner is
gw04 — the host that runs production missions. So `cargo test --workspace`
there has full access to the production docker daemon, and this test
REMOVES containers.

`adopt_existing` protects everything already present, but it cannot
protect a mission container created in the seconds between that call and
the sweep. On a laptop that race is nothing; on gw04 it is somebody's
mission.

So the destructive case now requires `CM_TEST_ORPHAN_SWEEP=1` and CI
simply does not run it. The read-only probes still run everywhere — they
create fixtures and inspect them, and never sweep.

This is the second time this test's blast radius has bitten: it reaped
two real local mission containers on its first run, and this would have
been the same mistake with production's daemon. The sweep is not the
problem — a sweep is global by nature — the harness around it is.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_018i9Ten1LU4jUr5d7TAWda9

crates/cm-api/tests/orphan_sweep.rs

@@ -188,6 +188,19 @@ async fn a_container_that_is_gone_reads_as_holding_work() {
     }
 }
 
+/// Set to run the destructive sweep test.
+///
+/// The other tests in this file only create fixtures and read them. This one
+/// calls `sweep_orphans`, which REMOVES containers — and CI runs
+/// `cargo test --workspace` inside a container with `/var/run/docker.sock`
+/// mounted, on gw04, which is the host that runs production missions.
+///
+/// `adopt_existing` protects everything already present, but it cannot protect
+/// a mission container created in the seconds between that call and the sweep.
+/// On a developer machine that race is nothing; on the production host it is a
+/// mission. So the destructive test is opt-in, and CI simply does not run it.
+const RUN_DESTRUCTIVE: &str = "CM_TEST_ORPHAN_SWEEP";
+
 /// The reap decision itself, against real containers.
 ///
 /// The probes above are the inputs; this is the act. A clean orphan past its
@@ -200,6 +213,14 @@ async fn the_sweep_reaps_the_clean_orphan_and_spares_the_others() {
         eprintln!("orphan_sweep: no docker — not run");
         return;
     }
+    if std::env::var(RUN_DESTRUCTIVE).is_err() {
+        eprintln!(
+            "orphan_sweep: not run — this test removes containers, and the CI \
+             runner shares a docker daemon with production. Set \
+             {RUN_DESTRUCTIVE}=1 to run it."
+        );
+        return;
+    }
     if MissionRuntimeProvisioner::from_env().is_none() {
         return;
     }