test: keep the payload root out of the developer's tree

One test stubs the transport a layer below `api()` — at `subprocess`, to
exercise the path a 422 really takes — so it reaches the real payload
write. That used to land in the test's own temp store, because the caller
named the directory; now the directory is `_gitea.PAYLOAD_ROOT`, resolved
from the module's location, and the file appeared in the developer's
`tmp/payload/`.

`StoreTestCase` patches `PAYLOAD_ROOT` to its fixture alongside the other
seams, and the rule in AGENTS.md gains the third directory a test must
not write to.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

AGENTS.md

@@ -106,12 +106,18 @@ stdlib-only and the tests hold the same line. `skills/*/scripts/` are not
 packages, so a test that needs the domain module imports it with
 `sys.path.insert`.
 
-**A test never touches `tmp/issues/` or `tmp/wiki/`.** Anything that needs a
+**A test never touches `tmp/issues/`, `tmp/wiki/` or `tmp/payload/`.** Anything
-store builds a throwaway repository in a `tempfile.TemporaryDirectory()` — a
+that needs a store builds a throwaway repository in a
-`.git` marker, a copy of the script layers, fixture issues or artifacts — and
+`tempfile.TemporaryDirectory()` — a `.git` marker, a copy of the script layers,
-runs the real scripts inside it as subprocesses. That is the only way to test
+fixture issues or artifacts — and runs the real scripts inside it as
-behavior that depends on where a script is run from, and it keeps the
+subprocesses. That is the only way to test behavior that depends on where a
-developer's own store out of the blast radius.
+script is run from, and it keeps the developer's own store out of the blast
+radius.
+
+`tmp/payload/` is in that list because `_gitea.PAYLOAD_ROOT` is resolved once,
+from the module's own location: a test that stubs the transport *below* `api()`
+— at `subprocess`, to exercise a non-2xx — reaches the real write. Such a test
+patches `PAYLOAD_ROOT` to its own temp directory too.
 
 ## Local issue store
 

tests/test_drop_after_push.py

@@ -194,7 +194,13 @@ class StoreTestCase(unittest.TestCase):
     def setUp(self):
         self.root = tempfile.mkdtemp(prefix="tea-drop-")
         self.fake = FakeTracker()
+        # PAYLOAD_ROOT is the repo's own tmp/payload, and a test that stubs the
+        # transport one layer down (see the non-2xx case) reaches the real
+        # write. Point it at the fixture: a test writes in its temp directory
+        # and nowhere else.
         for p in (mock.patch.object(_gitea, "api", self.fake.api),
+                  mock.patch.object(_gitea, "PAYLOAD_ROOT",
+                                    os.path.join(self.root, "payload")),
                   mock.patch.object(_gitea, "require_login", lambda: "test-login"),
                   mock.patch.object(push, "git_branch", lambda: "test-branch")):
             p.start()