lib-management.dep-fetcher-test v0.1.0: TAP suite + fixtures

27-assertion TAP-style suite for lib-management.dep-fetcher v0.1.0:

  - 4 internal-helper tests (id_to_path, gitea_slug_for incl. .git
    exception)
  - 6 JSON decoder tests (objects/arrays/nesting)
  - 3 conflict-detection tests (synthetic two-parent fixture)
  - 3 closure-walk tests (clean fixture, check_only mode)
  - 3 case-B (clean) tests
  - 4 case-C (dirty) tests
  - 4 case-D (wrong-tag → silent checkout, post-state verification)

Cases A (missing+clone) and E (broken describe) need network or
contrived corruption; out of scope for slice 5 per architecture spec.

Fixture matrix:
  conflict_a/  — static, no .git needed
  clean_b/     — .git at v0.1.0 (clean)
  dirty_c/     — .git at v0.1.0-1-g…-dirty
  wrong_tag_d/ — .git with tags v0.1.0 + v0.2.0, HEAD at v0.1.0

fixtures/_setup.sh reconstructs the .git states (idempotent — restores
manifest.lib content after the case-D silent-checkout side-effect).
Required pre-step before each test session; the test-runner blocks
with a clear error if fixtures/_setup.stamp is missing.

.gitignore covers the .git subdirs and the stamp file — they are
local-machine state, rebuilt by _setup.sh from the source-tracked
manifest.lib seed files.

fixtures/_setup.sh

@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+# fixtures/_setup.sh — reconstruct .git states for case B / C / D fixtures.
+#
+# Run before each invocation of the dep-fetcher-test-runner test-module.
+# Idempotent: deletes and re-creates each fixture's .git tree from
+# scratch so re-runs (and the case-D side effect — silent checkout —
+# don't pollute subsequent runs).
+#
+# Fixture matrix:
+#   clean_b/     — v0.1.0 tag, no extra commits, clean working-tree.
+#                  describe(<dir>) == "v0.1.0".
+#   dirty_c/     — v0.1.0 tag + 1 extra commit + 1 modified-file.
+#                  describe(<dir>) matches "^v0.1.0-1-g.*-dirty$".
+#   wrong_tag_d/ — v0.1.0 AND v0.2.0 tags. HEAD initially at v0.1.0
+#                  (module deps on v0.2.0, so dep-fetcher silently
+#                  checks out v0.2.0).
+#
+# After running, touches _setup.stamp so the test-module can verify
+# fixtures are prepared.
+#
+# Required: git on PATH. Run from any cwd — uses BASH_SOURCE to locate
+# the fixtures dir.
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Git identity to use for fixture commits. We avoid touching the user's
+# global git config (which the system-instruction explicitly forbids)
+# by setting per-repo config with `git -c` invocations downstream.
+GITNAME="dep-fetcher-fixtures"
+GITMAIL="fixtures@sporel.local"
+
+gitlocal() {
+    git -c "user.name=$GITNAME" -c "user.email=$GITMAIL" \
+        -c "commit.gpgsign=false" "$@"
+}
+
+prepare_clean_b() {
+    local d="$HERE/clean_b/install/libs/lib-x/consumer"
+    rm -rf "$d/.git"
+    (
+        cd "$d"
+        gitlocal init -q -b master
+        gitlocal add manifest.lib
+        gitlocal commit -q -m "lib-x.consumer v0.1.0"
+        gitlocal tag v0.1.0
+    )
+    echo "  clean_b: v0.1.0 (clean)"
+}
+
+prepare_dirty_c() {
+    local d="$HERE/dirty_c/install/libs/lib-x/consumer"
+    rm -rf "$d/.git"
+    rm -f  "$d/extra.txt"
+    # Restore the manifest in case a previous run left it modified.
+    cat > "$d/manifest.lib" <<'EOF'
+{
+  "id": "lib-x.consumer",
+  "version": "0.1.0",
+  "api_min": "0.1",
+  "deps": []
+}
+EOF
+    (
+        cd "$d"
+        gitlocal init -q -b master
+        gitlocal add manifest.lib
+        gitlocal commit -q -m "lib-x.consumer v0.1.0"
+        gitlocal tag v0.1.0
+        # +1 commit past the tag (drives "v0.1.0-1-g<sha>")
+        echo "extra" > extra.txt
+        gitlocal add extra.txt
+        gitlocal commit -q -m "extra commit past v0.1.0"
+        # +1 dirty file (drives "-dirty" suffix in describe --dirty)
+        echo "modified" >> manifest.lib
+    )
+    echo "  dirty_c: v0.1.0 + 1 commit + dirty file"
+}
+
+prepare_wrong_tag_d() {
+    local d="$HERE/wrong_tag_d/install/libs/lib-x/consumer"
+    rm -rf "$d/.git"
+    # Restore manifest in case a previous Case-D run left it patched
+    # to v0.2.0 (the checkout side-effect of the previous test run).
+    cat > "$d/manifest.lib" <<'EOF'
+{
+  "id": "lib-x.consumer",
+  "version": "0.1.0",
+  "api_min": "0.1",
+  "deps": []
+}
+EOF
+    (
+        cd "$d"
+        gitlocal init -q -b master
+        gitlocal add manifest.lib
+        gitlocal commit -q -m "lib-x.consumer v0.1.0"
+        gitlocal tag v0.1.0
+        # Bump to v0.2.0 with a real content change so the working-tree
+        # round-trips cleanly after the dep-fetcher's silent checkout.
+        cat > manifest.lib <<'EOF'
+{
+  "id": "lib-x.consumer",
+  "version": "0.2.0",
+  "api_min": "0.1",
+  "deps": []
+}
+EOF
+        gitlocal add manifest.lib
+        gitlocal commit -q -m "lib-x.consumer v0.2.0"
+        gitlocal tag v0.2.0
+        # Reset HEAD back to v0.1.0 so the initial describe sees the
+        # wrong tag (case D).
+        gitlocal checkout -q v0.1.0
+    )
+    echo "  wrong_tag_d: tags v0.1.0 + v0.2.0, HEAD at v0.1.0"
+}
+
+prepare_clean_b
+prepare_dirty_c
+prepare_wrong_tag_d
+
+# Stamp so the test-runner knows fixtures are prepared.
+touch "$HERE/_setup.stamp"
+
+echo "fixtures prepared at: $HERE"